Analysis

  • max time kernel
    131s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    08-09-2021 12:48

General

  • Target

    5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe

  • Size

    898KB

  • MD5

    cb2b4cd74c7b57a12bd822a168e4e608

  • SHA1

    f2182062719f0537071545b77ca75f39c2922bf5

  • SHA256

    5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed

  • SHA512

    7a38be8c1270b1224be4975ad442a964b2523c849f748e5356156cdce39e494c64ca80b0d99c1d989d77f072902de8972e0b113894c9791fb0cabf856dbba348

Score
3/10

Malware Config

Signatures

  • Program crash ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe"
    Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 924
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1588

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/1588-61-0x0000000000000000-mapping.dmp
                          • memory/1588-62-0x0000000000530000-0x0000000000531000-memory.dmp
                          • memory/1696-59-0x0000000075211000-0x0000000075213000-memory.dmp
                          • memory/1696-60-0x0000000000360000-0x0000000000393000-memory.dmp