Analysis
- max time kernel
31s - max time network
94s - platform
windows7_x64 - resource
win7v20201028 - submitted
16/02/2021, 14:19
General
- Target MV CHEN GLORY 1 Q88.DOC.exe
- Size 895KB
- Sample210216-1lyxake8f2
- SHA256 cbf5b54d5d1c70086efefea16f38b80a329cb96bb5a59e709b0ab2304acb157c
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MV CHEN GLORY 1 Q88.DOC.exe"C:\Users\Admin\AppData\Local\Temp\MV CHEN GLORY 1 Q88.DOC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 14402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1516-6-0x0000000001E70000-0x0000000001E81000-memory.dmp
memory/1516-9-0x0000000000330000-0x0000000000331000-memory.dmp
memory/1576-2-0x0000000075A41000-0x0000000075A43000-memory.dmp
memory/1576-3-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1576-7-0x0000000004F61000-0x0000000004FDA000-memory.dmp
memory/1576-8-0x0000000004FE0000-0x0000000005059000-memory.dmp
memory/1628-4-0x000007FEF6780000-0x000007FEF69FA000-memory.dmp