Malware Analysis Report

2024-10-16 03:13

Sample ID 210730-sklh7k9hbn
Target 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
SHA256 2f7d37c22e6199d1496f307c676223dda999c136ece4f2748975169b4a48afe5
Tags
score
3/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
3/10

SHA256

2f7d37c22e6199d1496f307c676223dda999c136ece4f2748975169b4a48afe5

Threat Level: Likely benign

The file 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1 was found to be: Likely benign.

Malicious Activity Summary


Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2021-07-30 08:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-07-30 08:06

Reported

2021-07-30 08:09

Platform

win7v20210408

Max time kernel

107s

Max time network

35s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe

"C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36

Network

N/A

Files

memory/1436-60-0x0000000000000000-mapping.dmp

memory/1436-61-0x00000000760B1000-0x00000000760B3000-memory.dmp

memory/1436-62-0x0000000000660000-0x0000000000661000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-07-30 08:06

Reported

2021-07-30 08:09

Platform

win10v20210410

Max time kernel

13s

Max time network

113s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe

"C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 228

Network

N/A

Files

N/A