Analysis

  • max time kernel
    20s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-11-2020 16:58

General

  • Target

    CVWSHSetup[1].bin/WSHSetup[1].exe

Score
3/10

Malware Config

Signatures

  • Program crash ⋅ 1 IoCs
  • NTFS ADS ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 14 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\WSHSetup[1].exe
    "C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\WSHSetup[1].exe"
    NTFS ADS
    PID:4656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1524
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3084

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/3084-0-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
                          • memory/3084-1-0x0000000005810000-0x0000000005811000-memory.dmp