Analysis
- max time kernel
10s - max time network
12s - platform
windows7_x64 - resource
win7v20201028 - submitted
25/03/2021, 09:48
General
- Target 12c46e15136f351bdb64f4d62a57f90d.exe
- Size 92KB
- Sample210325-wwtpkbd2c6
- SHA256 362911dc126bfc3bf0edde07ab4dcf66e79830f1da312942b1731b6f45ac9da5
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12c46e15136f351bdb64f4d62a57f90d.exe"C:\Users\Admin\AppData\Local\Temp\12c46e15136f351bdb64f4d62a57f90d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1656 -s 10882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1404-7-0x000007FEFC251000-0x000007FEFC253000-memory.dmp
memory/1404-8-0x0000000001E60000-0x0000000001E71000-memory.dmp
memory/1404-9-0x0000000000410000-0x0000000000411000-memory.dmp
memory/1656-2-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp
memory/1656-3-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/1656-5-0x000000001AE80000-0x000000001AE82000-memory.dmp