Analysis
- max time kernel
122s - max time network
122s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
10/11/2021, 14:08
General
- Target Payment 2280_2.xll.dll
- Size 647KB
- Sample211110-rfj54shbe3
- SHA256 456b0fd1d64450963bfcce17ef195ec97ae8e2c142bb2b598e32f63b671e6e2d
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Payment 2280_2.xll.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\Payment 2280_2.xll.dll"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/368-55-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp
memory/1172-57-0x00000000751C1000-0x00000000751C3000-memory.dmp
memory/1172-58-0x0000000000310000-0x000000000031C000-memory.dmp
memory/1172-60-0x0000000004701000-0x0000000004702000-memory.dmp
memory/1172-61-0x0000000004702000-0x0000000004703000-memory.dmp
memory/1172-62-0x0000000004703000-0x0000000004704000-memory.dmp
memory/1172-63-0x0000000004A20000-0x0000000004B9E000-memory.dmp
memory/1172-64-0x0000000000680000-0x00000000006B6000-memory.dmp
memory/1172-65-0x0000000004704000-0x0000000004706000-memory.dmp
memory/1172-66-0x00000000006D0000-0x00000000006DA000-memory.dmp
memory/1172-67-0x000000000470A000-0x000000000471B000-memory.dmp