3f987bb8c8f01c7c6d78d03aef0062b01fffd332860f3f7e9e29710466062dc2 | Triage™

Analysis

max time kernel
151s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
24/06/2021, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3F987BB8C8F01C7C6D78D03AEF0062B01FFFD332860F3.exe
Size 628KB
Sample210624-e72j2c27bs
SHA256 3f987bb8c8f01c7c6d78d03aef0062b01fffd332860f3f7e9e29710466062dc2
MD5 4bbc22b28abf463d2e2ef300c7cad6dd
SHA1 cd56c415be598974425c8dcc5e6d9a8bb090b14f
SHA512 53a8ea2ca2cbbedf536efd81ab535d758cf2eabd3a437a7f0c4c8a13e92f0b76bafae59594773664156e68c981670cf14dc2b4ac3a7934a72476946f91756ced
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\wordd\explorre.exe:ZoneIdentifier	3F987BB8C8F01C7C6D78D03AEF0062B01FFFD332860F3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3716	3F987BB8C8F01C7C6D78D03AEF0062B01FFFD332860F3.exe
3716	3F987BB8C8F01C7C6D78D03AEF0062B01FFFD332860F3.exe

C:\Users\Admin\AppData\Local\Temp\3F987BB8C8F01C7C6D78D03AEF0062B01FFFD332860F3.exe
"C:\Users\Admin\AppData\Local\Temp\3F987BB8C8F01C7C6D78D03AEF0062B01FFFD332860F3.exe"
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3716
- C:\Users\Admin\AppData\Roaming\wordd\explorre.exe
  "C:\Users\Admin\AppData\Roaming\wordd\explorre.exe"
  2⤵
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-114-0x0000000000740000-0x0000000000741000-memory.dmp

Download