Analysis
- max time kernel
147s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
05/11/2020, 04:30
General
- Target igfx.sfx.exe
- Size 703KB
- Sample201105-lb6sj32bsa
- SHA256 ee2e84f75b0b6043c2a2e3b84bdeabc0be4a4a1e4c6ec6a3ff255963b545425d
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\igfx.sfx.exe"C:\Users\Admin\AppData\Local\Temp\igfx.sfx.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\igfx.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\igfx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3012-17-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/3012-16-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/3012-20-0x0000000005CB0000-0x0000000005CB1000-memory.dmp
memory/3012-19-0x0000000005A60000-0x0000000005A61000-memory.dmp
memory/3012-18-0x0000000005FC0000-0x0000000005FC1000-memory.dmp
memory/3012-10-0x0000000000400000-0x0000000000484000-memory.dmp
memory/3012-12-0x0000000072140000-0x000000007282E000-memory.dmp
memory/3012-15-0x00000000052B0000-0x00000000052B1000-memory.dmp
memory/3884-9-0x00000000027E0000-0x00000000027ED000-memory.dmp
memory/3884-5-0x00000000721B0000-0x000000007289E000-memory.dmp
memory/3884-8-0x0000000005070000-0x00000000050B3000-memory.dmp
memory/3884-6-0x0000000000470000-0x0000000000471000-memory.dmp