Overview

overview

3

Static

static

SecuriteIn...00.exe

windows7_x64

3

SecuriteIn...00.exe

windows10_x64

3

Analysis

  • max time kernel
    13s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    28-03-2021 02:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe

  • Size

    2.2MB

  • MD5

    a6142de2699d423a11dd8e21a6f619a1

  • SHA1

    d8009583e2da6bf00ec4e327c3949306cd467b98

  • SHA256

    1ccc7c5ad9f6685164eb8fcc6bc8e94db915167375946f04841bf6ac0972674e

  • SHA512

    d1fb690a4e88e86d35e3bbae2bcc60413dba3f9496da197d5e5e029bc48ceed8216f017f90c294fefb43fdbbc77229a3f6e07aa496dddd5c00684b4653c49ead

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe" 1
      2⤵
        PID:3980

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\SecuriteInfo.com.Adware.WizzMonetize.1.3832.21500.exe.log
      MD5

      fa65eca2a4aba58889fe1ec275a058a8

      SHA1

      0ecb3c6e40de54509d93570e58e849e71194557a

      SHA256

      95e69d66188dd8287589817851941e167b0193638f4a7225c73ffbd3913c0c2e

      SHA512

      916899c5bfc2d1bef93ab0bf80a7db44b59a132c64fa4d6ab3f7d786ad857b747017aab4060e5a9a77775587700b2ac597c842230172a97544d82521bfc36dff

      Download Submit
    • memory/3980-4-0x0000000000000000-mapping.dmp
      Download
    • memory/3980-6-0x00007FFCF2920000-0x00007FFCF32C0000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/3980-7-0x0000000002630000-0x0000000002632000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4696-2-0x0000000002950000-0x0000000002952000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4696-3-0x00007FFCF2920000-0x00007FFCF32C0000-memory.dmp
      Filesize

      9.6MB

      Download