Resubmissions
15-09-2021 06:42
210915-hgtlhadaer 1014-09-2021 08:06
210914-jzwz1sacfj 1010-09-2021 11:57
210910-n4w8ssdbdp 1008-09-2021 11:10
210908-m965hshefk 10Analysis
-
max time kernel
26s -
max time network
26s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 06:42
General
-
Target
championship.inf.dll
-
Size
2.0MB
-
MD5
0b7da6388091ff9d696a18c95d41b587
-
SHA1
6c10d7d88606ac1afd30b4e61bf232329a276cdc
-
SHA256
6eedf45cb91f6762de4e35e36bcb03e5ad60ce9ac5a08caeb7eda035cd74762b
-
SHA512
45b26e8f9885dca6f4e1984fc39cb4c2a5b5988c970f35dde987b7a5a8417acbe5e972a6602071e903425f91a9095c7c289e574c3bad3039324185ad85d06a9a
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Deletes itself 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\championship.inf.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windows Mail\wabmig.exe"C:\Program Files\Windows Mail\wabmig.exe"1⤵
- Process spawned unexpected child process
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "Sleep 5 ; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\championship.inf.dll" -Force1⤵
- Process spawned unexpected child process
- Deletes itself
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB