4e9cb6e83b7ea6e353bafe82262c6b1c1de8a5fb5517fa8bd8bd80b353ca472d | Triage™

Analysis

max time kernel
122s
max time network
127s
platform
windows10_x64
resource
win10-en-20210920
submitted
18/10/2021, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Diagram and Specifications.exe
Size 397KB
Sample211018-l3yn5aecgn
SHA256 4e9cb6e83b7ea6e353bafe82262c6b1c1de8a5fb5517fa8bd8bd80b353ca472d
MD5 7ddf9139b29b7b35647dfa9e585023de
SHA1 ff9455ae69b531bf1864ece4ab90dd8186f1ae28
SHA512 a4e66072f3bbb32e6f5594065eba358a05113c7e56b3e149c68dfd4905661489385af03e9a1d89d9c087a856a88c5ee699fc3c6f9a212962856988c89a81aad2
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
528	dw20.exe
528	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	528	dw20.exe
Token: SeBackupPrivilege	528	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 528	3144	Diagram and Specifications.exe	71
PID 3144 wrote to memory of 528	3144	Diagram and Specifications.exe	71
PID 3144 wrote to memory of 528	3144	Diagram and Specifications.exe	71

C:\Users\Admin\AppData\Local\Temp\Diagram and Specifications.exe
"C:\Users\Admin\AppData\Local\Temp\Diagram and Specifications.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 860
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-115-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download