Analysis
- max time kernel
111s - max time network
127s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
17/11/2021, 02:46
General
- Target 우리의 새로운 주문을 인용하십시오_H7790,pdf.exe
- Size 968KB
- Sample211117-c9bcqsdfcj
- SHA256 bc434d6f3e71a7996405b339d78e45741bd7b251df9da7d5d0ef19a13c968086
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\우리의 새로운 주문을 인용하십시오_H7790,pdf.exe"C:\Users\Admin\AppData\Local\Temp\우리의 새로운 주문을 인용하십시오_H7790,pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 11802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3160-118-0x0000000000710000-0x0000000000711000-memory.dmp
memory/3160-120-0x0000000005740000-0x0000000005741000-memory.dmp
memory/3160-121-0x0000000005240000-0x0000000005241000-memory.dmp
memory/3160-122-0x0000000005170000-0x0000000005171000-memory.dmp
memory/3160-123-0x0000000005430000-0x0000000005437000-memory.dmp
memory/3160-124-0x0000000005110000-0x00000000051A2000-memory.dmp
memory/3160-125-0x0000000007620000-0x0000000007621000-memory.dmp
memory/3160-126-0x0000000007720000-0x000000000777A000-memory.dmp
memory/3160-127-0x0000000007780000-0x00000000077B9000-memory.dmp