Analysis
- max time kernel
40s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
07/12/2020, 15:50
General
- Target SecuriteInfo.com.Mal.Generic-S.11288.3887.exe
- Size 44KB
- Sample201207-fxrmjbhvta
- SHA256 bdd6660a13a447a54579212db05e971b87d2c2b986ecdd6565d7c47d75d4701f
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.Generic-S.11288.3887.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.Generic-S.11288.3887.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.3532⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 4.3533⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 19722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1048-2-0x0000000073BE0000-0x00000000742CE000-memory.dmp
memory/1048-3-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/1048-4-0x0000000005320000-0x0000000005321000-memory.dmp
memory/1048-5-0x00000000058C0000-0x00000000058C1000-memory.dmp
memory/2132-8-0x0000000004510000-0x0000000004511000-memory.dmp
memory/2132-9-0x0000000004DC0000-0x0000000004DC1000-memory.dmp