Overview

overview

10

Static

static

nwamamassloga.scr

windows7_x64

1

nwamamassloga.scr

windows10_x64

10

Analysis

  • max time kernel
    12s
  • max time network
    10s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-12-2020 08:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    nwamamassloga.scr

  • Size

    6.0MB

  • MD5

    8d3ae4916c4df02016b0ac0e900341e5

  • SHA1

    6ccab03ec2c6ecfebc013dd39c84d03742f541e8

  • SHA256

    d25be05d2b6dc4275fb36d639f4e3e4598e42b904d0748e0574941cb6899ba51

  • SHA512

    8840533d06655949d54e8c7fba6a868c5244744226b574c4d5f25da84caddc4a6543bd7b5a8183278be29d0bdda5f29473a6c652f9d93ce6ad7278da41c2799f

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr
    "C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr
      "C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"
      2⤵
        PID:1216
      • C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr
        "C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"
        2⤵
          PID:1364
        • C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr
          "C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"
          2⤵
            PID:1444
          • C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr
            "C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"
            2⤵
              PID:1220
            • C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr
              "C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"
              2⤵
                PID:608

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/848-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp
              Filesize

              6.9MB

              Download
            • memory/848-3-0x0000000000170000-0x0000000000171000-memory.dmp
              Filesize

              4KB

              Download
            • memory/848-5-0x0000000004650000-0x00000000046E4000-memory.dmp
              Filesize

              592KB

              Download