1ccc7c5ad9f6685164eb8fcc6bc8e94db915167375946f04841bf6ac0972674e

Analysis

max time kernel
65s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
28-03-2021 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe
Size

2.2MB
MD5

a6142de2699d423a11dd8e21a6f619a1
SHA1

d8009583e2da6bf00ec4e327c3949306cd467b98
SHA256

1ccc7c5ad9f6685164eb8fcc6bc8e94db915167375946f04841bf6ac0972674e
SHA512

d1fb690a4e88e86d35e3bbae2bcc60413dba3f9496da197d5e5e029bc48ceed8216f017f90c294fefb43fdbbc77229a3f6e07aa496dddd5c00684b4653c49ead

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe

description	pid	process	target process
PID 1908 wrote to memory of 1896	1908	SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe	SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe
PID 1908 wrote to memory of 1896	1908	SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe	SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe
PID 1908 wrote to memory of 1896	1908	SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe	SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe" 1
2⤵
PID:1896

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1896-5-0x0000000000000000-mapping.dmp

Download
memory/1896-6-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1896-7-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1896-8-0x0000000002000000-0x0000000002002000-memory.dmp

Filesize
8KB

Download
memory/1908-2-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1908-3-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1908-4-0x00000000021A0000-0x00000000021A2000-memory.dmp

Filesize
8KB

Download