Overview

overview

8

Static

static

CertifyThe...12.exe

windows7_x64

8

CertifyThe...12.exe

windows10_x64

8

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    01-11-2020 08:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CertifyTheWebSetup_V5.1.12.exe

  • Size

    12.4MB

  • MD5

    7e7db923e1269af3ce5247c8bac5a1aa

  • SHA1

    b1cb7bfb284080526b15051eeb4663a625265947

  • SHA256

    2c35fc20c4409bfe335b2e3ab14e635ac4cf6a9c674853717395c3ce0cb2ca1f

  • SHA512

    5ce6fe5d314f913019a6664858d26f7f4edff9e14934f66d561acdb8f13d72b95c1ac642c941419a73b0dbd0b08f89fd4575f03de50e96a66065a7265bd5062d

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CertifyTheWebSetup_V5.1.12.exe
    "C:\Users\Admin\AppData\Local\Temp\CertifyTheWebSetup_V5.1.12.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Users\Admin\AppData\Local\Temp\is-JGPD3.tmp\CertifyTheWebSetup_V5.1.12.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JGPD3.tmp\CertifyTheWebSetup_V5.1.12.tmp" /SL5="$301EA,12223430,1145856,C:\Users\Admin\AppData\Local\Temp\CertifyTheWebSetup_V5.1.12.exe"
      2⤵
      • Executes dropped EXE
      PID:3468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-JGPD3.tmp\CertifyTheWebSetup_V5.1.12.tmp
    MD5

    f6ef3b7960a891b8065e07322dac0b26

    SHA1

    0811aee541063e3191e65af94e1254dc30248263

    SHA256

    cde66d9c027e286ebde90b58be60327c28fde9b8ecb0591558e3338cd6a8b57c

    SHA512

    5d59497d0533c59f6cc71e0fe38266afa16889ec6da398cce5ac80ebf5bc44b4c3a169d5bf55ac2d8dcdd68de0058f8fc43ca654347de62e54ad43b5aa72db5e

    Download Submit
  • memory/3468-0-0x0000000000000000-mapping.dmp
    Download