Analysis
-
max time kernel
52s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-01-2021 09:38
Static task
static1
Behavioral task
behavioral1
Sample
C.V. - application letter.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
C.V. - application letter.exe
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
C.V. - application letter.exe
-
Size
733KB
-
MD5
ceddee60268daabd5b6f11861aaaf58a
-
SHA1
d845bc78df9e125e61042211903fc0e454aa249b
-
SHA256
0c490787fce8baf58cbf1d2f5fcf53f6a289635e3ea1652d04fee08c9611aff6
-
SHA512
3dcf50c2a8f0a0dcdb13dc01115489b970c4addae5aa1585dbd54b1580d510ae13932bff964b9199cd4e41dab72ecf18d114abcbd045f96075c066775b1e8500
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
C.V. - application letter.exepid process 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe 1584 C.V. - application letter.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
C.V. - application letter.exedescription pid process Token: SeDebugPrivilege 1584 C.V. - application letter.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
C.V. - application letter.exedescription pid process target process PID 1584 wrote to memory of 888 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 888 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 888 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 888 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1388 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1388 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1388 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1388 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1448 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1448 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1448 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1448 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1648 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1648 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1648 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1648 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1540 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1540 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1540 1584 C.V. - application letter.exe C.V. - application letter.exe PID 1584 wrote to memory of 1540 1584 C.V. - application letter.exe C.V. - application letter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\C.V. - application letter.exe"C:\Users\Admin\AppData\Local\Temp\C.V. - application letter.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C.V. - application letter.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\C.V. - application letter.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\C.V. - application letter.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\C.V. - application letter.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\C.V. - application letter.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1584-2-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1584-3-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1584-5-0x0000000000630000-0x000000000063E000-memory.dmpFilesize
56KB
-
memory/1584-6-0x0000000005730000-0x00000000057B5000-memory.dmpFilesize
532KB