Analysis
-
max time kernel
127s -
max time network
70s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-05-2021 17:39
General
-
Target
Purchase Orders - Foreign_000000000088707.exe
-
Size
449KB
-
MD5
ebfe963401c01212c017ba9281bfcbc3
-
SHA1
51eda08a4839939950fb904c45fbc0ea1ff2ab5a
-
SHA256
f4be91d5771599ee3f80dd26990d324c291e4b327db563c15379b09ffa79eadb
-
SHA512
1f076d5f8c94b89a9568771ef57539c4ae1bfad1b47c2f69354495c177ff030060b663951dc139a0ca78436977e8c72ddebe2d9f94fc68a4648e018942e4c4b9
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 11122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB