59dde91666a7dfcb1d2c8ad1f5e4a8ed7ede43b084ac1c13be4be00a0342afee | Triage™

Analysis

max time kernel
120s
max time network
123s
platform
windows10_x64
resource
win10v20201028
submitted
22/12/2020, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67b80ca172c94c56152fb239cd5279d7.exe
Size 320KB
Sample201222-t953em4ctn
SHA256 59dde91666a7dfcb1d2c8ad1f5e4a8ed7ede43b084ac1c13be4be00a0342afee
MD5 67b80ca172c94c56152fb239cd5279d7
SHA1 d73844e907caa0b385081e32e9a837dbd2745240
SHA512 68822b4ef79aed72891b807384d3dd23178421deee768a228e2b8215f6e806b7acb0846e5d45b8aa5346eb74dd1b1f02d683dd744b171d0e34b8435d70c9bac5
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 8 IoCs

flow	pid	Process
14	4120	wscript.exe
15	4120	wscript.exe
17	4120	wscript.exe
19	4120	wscript.exe
23	4120	wscript.exe
25	4120	wscript.exe
26	4120	wscript.exe
27	4120	wscript.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\RarSFX0\wscript:wscript	67b80ca172c94c56152fb239cd5279d7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4120	4700	67b80ca172c94c56152fb239cd5279d7.exe	74
PID 4700 wrote to memory of 4120	4700	67b80ca172c94c56152fb239cd5279d7.exe	74
PID 4700 wrote to memory of 4120	4700	67b80ca172c94c56152fb239cd5279d7.exe	74

C:\Users\Admin\AppData\Local\Temp\67b80ca172c94c56152fb239cd5279d7.exe
"C:\Users\Admin\AppData\Local\Temp\67b80ca172c94c56152fb239cd5279d7.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" /E:vbs wscript:wscript
  2⤵
  - Blocklisted process makes network request
  PID:4120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4700-2-0x00000000031E0000-0x00000000031E1000-memory.dmp

Download