b2ffebf2df5b70d6866b2bb65a56ecafa59371fc78f3690790bb273c715df683 | Triage

Analysis

max time kernel
103s
max time network
106s
platform
windows7_x64
resource
win7v20201028
submitted
04-03-2021 18:19

Sharing

Report Analysis Logs

General

Target

01a083f4_extracted.exe
Size

146KB
MD5

c5c6f5d743b1d2391b150c9740db22ba
SHA1

f033a2fab1ad3a6e8d4ab08730654fc6f3482a4e
SHA256

b2ffebf2df5b70d6866b2bb65a56ecafa59371fc78f3690790bb273c715df683
SHA512

6bf5d23f2f82b02dd194716d747b99858823915fccb09b39a842f5a221b2d933e8c53d0158fe4806bde644f96aa9d28699ec4ab702d71e55d93feb0f384f843e

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1464 taskkill.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

01a083f4_extracted.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 1652 01a083f4_extracted.exe
Token: SeDebugPrivilege 1464 taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

01a083f4_extracted.execmd.exe

description	pid	process	target process
PID 1652 wrote to memory of 1472	1652	01a083f4_extracted.exe	cmd.exe
PID 1652 wrote to memory of 1472	1652	01a083f4_extracted.exe	cmd.exe
PID 1652 wrote to memory of 1472	1652	01a083f4_extracted.exe	cmd.exe
PID 1652 wrote to memory of 1472	1652	01a083f4_extracted.exe	cmd.exe
PID 1472 wrote to memory of 1464	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1464	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1464	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1464	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1772	1472	cmd.exe	choice.exe
PID 1472 wrote to memory of 1772	1472	cmd.exe	choice.exe
PID 1472 wrote to memory of 1772	1472	cmd.exe	choice.exe
PID 1472 wrote to memory of 1772	1472	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\01a083f4_extracted.exe
"C:\Users\Admin\AppData\Local\Temp\01a083f4_extracted.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 1652 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\01a083f4_extracted.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 1652
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-7-0x0000000000000000-mapping.dmp

Download
memory/1472-6-0x0000000000000000-mapping.dmp

Download
memory/1652-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1652-3-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1652-5-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/1772-8-0x0000000000000000-mapping.dmp

Download