Analysis
- max time kernel
34s - max time network
33s - platform
windows7_x64 - resource
win7v20201028 - submitted
28/02/2021, 10:40
General
- Target Paid Invoice _confirmation_9336639_03993736553.exe
- Size 1.1MB
- Sample210228-n4sr2ceaxa
- SHA256 86eb335425ab87285d7fc03826498925262e64a466fac29d22c8ae1a806feaae
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Paid Invoice _confirmation_9336639_03993736553.exe"C:\Users\Admin\AppData\Local\Temp\Paid Invoice _confirmation_9336639_03993736553.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\Windows\System32\secinit.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 1723⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/548-5-0x000007FEF6F80000-0x000007FEF71FA000-memory.dmp
memory/952-17-0x0000000000AB0000-0x0000000000AC1000-memory.dmp
memory/952-23-0x0000000000910000-0x0000000000911000-memory.dmp
memory/1080-10-0x0000000000080000-0x0000000000081000-memory.dmp
memory/1080-12-0x00000000000C0000-0x00000000000C1000-memory.dmp
memory/1080-14-0x0000000000130000-0x0000000000131000-memory.dmp
memory/1080-22-0x0000000010590000-0x000000001060C000-memory.dmp
memory/1648-2-0x0000000074D11000-0x0000000074D13000-memory.dmp
memory/1648-3-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1648-4-0x00000000003A0000-0x00000000003BB000-memory.dmp