Analysis
-
max time kernel
106s -
max time network
110s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-09-2021 09:24
Static task
static1
Behavioral task
behavioral1
Sample
Payment.exe
Resource
win7-en-20210920
0 signatures
0 seconds
General
-
Target
Payment.exe
-
Size
149KB
-
MD5
46a9cde2229b45d390ad40ce0cc997f9
-
SHA1
ddf3a356e42d2a15ccd930b0d5c6d7077824ef8f
-
SHA256
4c4a0595a5ac3499e7d398aa9cbbea5fc5a77836be706c50bbae6dd7c0c6aadb
-
SHA512
75a082b7a9a0df0a2b9f26fffcf8592f13d46c2b5bffc8830a100efcdd4cfa8394bb2a567f74c4c890f4f9cdcdeb103900cbb2990494971a119e2d128910340f
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 608 1368 WerFault.exe Payment.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 608 WerFault.exe 608 WerFault.exe 608 WerFault.exe 608 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Payment.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1368 Payment.exe Token: SeDebugPrivilege 608 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Payment.exedescription pid process target process PID 1368 wrote to memory of 608 1368 Payment.exe WerFault.exe PID 1368 wrote to memory of 608 1368 Payment.exe WerFault.exe PID 1368 wrote to memory of 608 1368 Payment.exe WerFault.exe PID 1368 wrote to memory of 608 1368 Payment.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment.exe"C:\Users\Admin\AppData\Local\Temp\Payment.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 10962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/608-57-0x0000000000000000-mapping.dmp
-
memory/608-58-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1368-53-0x0000000000E40000-0x0000000000E41000-memory.dmpFilesize
4KB
-
memory/1368-55-0x00000000768C1000-0x00000000768C3000-memory.dmpFilesize
8KB
-
memory/1368-56-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB