Resubmissions

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

  • max time kernel
    363s
  • max time network
    447s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 13:14

General

  • Target

    CVWSHSetup[1].bin/WSHSetup[1].exe

Score
3/10

Malware Config

Signatures

  • Program crash ⋅ 1 IoCs
  • NTFS ADS ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 14 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\WSHSetup[1].exe
    "C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\WSHSetup[1].exe"
    NTFS ADS
    PID:4724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1524
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3220

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/3220-0-0x0000000004E80000-0x0000000004E81000-memory.dmp
                          • memory/3220-1-0x00000000055C0000-0x00000000055C1000-memory.dmp