Analysis
-
max time kernel
20s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-03-2021 16:36
Static task
static1
Behavioral task
behavioral1
Sample
1dizrriv.xml.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1dizrriv.xml.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
fires_258452962.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
fires_258452962.exe
Resource
win10v20201028
General
-
Target
1dizrriv.xml.exe
-
Size
3.4MB
-
MD5
659ddd8e403cde0e6403d605829d0f3b
-
SHA1
c76efe026ba7761563b889d7ff5dc47f37ce8e89
-
SHA256
bf5d0e8f30d74f2b00fcd1c5ee90c800b81c9b371e162b884278518925daab84
-
SHA512
44eb56bd5bd77dc886d3cc8eda1e2c2b503d605766b2e72444141f3c48b691bbd2ee807b54242c9530f9b9cc17f2a413b69256b5f8302b9946efa0c77be72906
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1184 1576 WerFault.exe 1dizrriv.xml.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1184 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1dizrriv.xml.exedescription pid process target process PID 1576 wrote to memory of 1184 1576 1dizrriv.xml.exe WerFault.exe PID 1576 wrote to memory of 1184 1576 1dizrriv.xml.exe WerFault.exe PID 1576 wrote to memory of 1184 1576 1dizrriv.xml.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dizrriv.xml.exe"C:\Users\Admin\AppData\Local\Temp\1dizrriv.xml.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1576 -s 5322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-6-0x0000000000000000-mapping.dmp
-
memory/1184-8-0x000007FEFC101000-0x000007FEFC103000-memory.dmpFilesize
8KB
-
memory/1184-9-0x0000000001E50000-0x0000000001E61000-memory.dmpFilesize
68KB
-
memory/1184-12-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1576-2-0x000007FEF5C50000-0x000007FEF663C000-memory.dmpFilesize
9.9MB
-
memory/1576-3-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/1576-5-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1576-7-0x000000001B1B0000-0x000000001B1B2000-memory.dmpFilesize
8KB