Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    06-10-2021 09:35

General

  • Target

    533fe2e3602ede540e261fef7e04b711.exe

  • Size

    60KB

  • MD5

    533fe2e3602ede540e261fef7e04b711

  • SHA1

    945e2931b4ca160f9f3025e740cc19e75db25bf6

  • SHA256

    1a55b87ef779fe996b8aef3e98ea9252a5ce3a02d3a0a87000554bd41033a215

  • SHA512

    c43c0587b660b8f3a03d04e04c953c7ba5375dfec6f23de71e0bab7888e154216a8c38b9f422d854ef14483b6fac93874e0d5483634c7d6d6497088268453184

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\533fe2e3602ede540e261fef7e04b711.exe
    "C:\Users\Admin\AppData\Local\Temp\533fe2e3602ede540e261fef7e04b711.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 1536
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1176

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1176-64-0x0000000000000000-mapping.dmp

  • memory/1176-65-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1828-60-0x00000000008F0000-0x00000000008F1000-memory.dmp

    Filesize

    4KB

  • memory/1828-62-0x00000000762C1000-0x00000000762C3000-memory.dmp

    Filesize

    8KB

  • memory/1828-63-0x00000000006A0000-0x00000000006A1000-memory.dmp

    Filesize

    4KB