Analysis

  • max time kernel
    151s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    04-02-2021 16:44

General

  • Target

    c342af62302936720e52679bc431d5a8.exe

  • Size

    156KB

  • MD5

    c342af62302936720e52679bc431d5a8

  • SHA1

    799f21d34bcd5c417337207aecf1d85e5da72879

  • SHA256

    2178eda7504a62c0451e35bf26f56c4f699940f359efc0b82dc662f964144415

  • SHA512

    91f13eaac3f86bf957da25a21ae524f80056ffbea45247fed45651f50ab2dd706161694e76a46fef70e11befa2beb3d5c603f74d8ed482f5e60bc7da238b16ec

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2414 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c342af62302936720e52679bc431d5a8.exe
    "C:\Users\Admin\AppData\Local\Temp\c342af62302936720e52679bc431d5a8.exe"
    1⤵
    • Modifies Internet Explorer Protected Mode
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Users\Admin\AppData\Local\Temp\c342af62302936720e52679bc431d5a8.exe
      C:\Users\Admin\AppData\Local\Temp\c342af62302936720e52679bc431d5a8.exe --vwxyz
      2⤵
        PID:1500

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/532-2-0x0000000075C61000-0x0000000075C63000-memory.dmp
      Filesize

      8KB

    • memory/1500-3-0x0000000000000000-mapping.dmp
    • memory/1960-5-0x000007FEF7040000-0x000007FEF72BA000-memory.dmp
      Filesize

      2MB