Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
17/11/2021, 02:46
General
- Target 우리의 새로운 주문을 인용하십시오_H7790,pdf.exe
- Size 968KB
- Sample211117-c9bcqsdfcj
- SHA256 bc434d6f3e71a7996405b339d78e45741bd7b251df9da7d5d0ef19a13c968086
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\우리의 새로운 주문을 인용하십시오_H7790,pdf.exe"C:\Users\Admin\AppData\Local\Temp\우리의 새로운 주문을 인용하십시오_H7790,pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 6802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/816-55-0x0000000000330000-0x0000000000331000-memory.dmp
memory/816-57-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/816-58-0x0000000001EF0000-0x0000000001EF7000-memory.dmp
memory/816-59-0x0000000004CA0000-0x0000000004CFA000-memory.dmp
memory/816-60-0x0000000001F70000-0x0000000001FA9000-memory.dmp
memory/848-62-0x0000000001CD0000-0x0000000001CD1000-memory.dmp