Analysis
- max time kernel
46s - max time network
69s - platform
windows10_x64 - resource
win10v200722 - submitted
14/10/2020, 15:12
General
- Target Mediform S.A Order Specification Requirement.exe
- Size 620KB
- Sample201014-g37t9fk69a
- SHA256 20170bf3dca7d3440fa50382a81ca7802fa021b68b8830f286fe02113d24d850
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mediform S.A Order Specification Requirement.exe"C:\Users\Admin\AppData\Local\Temp\Mediform S.A Order Specification Requirement.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mediform S.A Order Specification Requirement.exe"{path}"2⤵
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3076-7-0x0000000007750000-0x0000000007751000-memory.dmp
memory/3076-3-0x0000000005760000-0x0000000005761000-memory.dmp
memory/3076-4-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/3076-5-0x0000000005320000-0x0000000005321000-memory.dmp
memory/3076-6-0x0000000005400000-0x0000000005404000-memory.dmp
memory/3076-0-0x0000000073250000-0x000000007393E000-memory.dmp
memory/3076-8-0x00000000076A0000-0x00000000076F6000-memory.dmp
memory/3076-9-0x0000000002C40000-0x0000000002C7F000-memory.dmp
memory/3076-1-0x00000000008B0000-0x00000000008B1000-memory.dmp
memory/3692-10-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3692-13-0x0000000073250000-0x000000007393E000-memory.dmp