Analysis
-
max time kernel
99s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 08:29
Static task
static1
Behavioral task
behavioral1
Sample
DOC98374933_JULY2021.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DOC98374933_JULY2021.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
DOC98374933_JULY2021.exe
-
Size
1.1MB
-
MD5
7cdabce07469c95df2bfe4bb692757d5
-
SHA1
be7905986d224b15517c5b41d4fc30fec309bd8e
-
SHA256
242acd2bd4415b211de8afd058570aac478e1c257d31e908a2823b8fb3788ede
-
SHA512
15fb71bf0912a3083590c454eacb37ea1e8954d2ce63de1910073192d767ca48ffd0a7192cb095799461a97ce680751bff30f59e5815c327cd9c767322fdc060
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
DOC98374933_JULY2021.exepid process 1084 DOC98374933_JULY2021.exe 1084 DOC98374933_JULY2021.exe 1084 DOC98374933_JULY2021.exe 1084 DOC98374933_JULY2021.exe 1084 DOC98374933_JULY2021.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DOC98374933_JULY2021.exedescription pid process Token: SeDebugPrivilege 1084 DOC98374933_JULY2021.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
DOC98374933_JULY2021.exedescription pid process target process PID 1084 wrote to memory of 300 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 300 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 300 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 300 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1472 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1472 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1472 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1472 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1480 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1480 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1480 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1480 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1300 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1300 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1300 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1300 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1176 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1176 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1176 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe PID 1084 wrote to memory of 1176 1084 DOC98374933_JULY2021.exe DOC98374933_JULY2021.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"C:\Users\Admin\AppData\Local\Temp\DOC98374933_JULY2021.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1084-59-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1084-61-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1084-62-0x0000000000370000-0x000000000038B000-memory.dmpFilesize
108KB
-
memory/1084-63-0x0000000005C60000-0x0000000005CDD000-memory.dmpFilesize
500KB
-
memory/1084-64-0x0000000000900000-0x0000000000938000-memory.dmpFilesize
224KB