Overview

overview

3

Static

static

pag. Grass...69.exe

windows7_x64

3

pag. Grass...69.exe

windows10_x64

3

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    25-11-2021 16:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    pag. Grasso. prof. 21414969.exe

  • Size

    497KB

  • MD5

    692908f10464b82d0510ef2383aa9a32

  • SHA1

    2ba285a22ae7ab864cba4f9267ad4709328d6445

  • SHA256

    6217660fe11127132c6c3408e2b8980181a1074cfedb39290deb945610f612a9

  • SHA512

    1cda86749eeb1c683272120a3bffa4e884c399e923c7145c3a99309e65c25b01adfe555abaf453668046753b18c2aada0214feff6045770d5dec634dd2bb0067

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pag. Grasso. prof. 21414969.exe
    "C:\Users\Admin\AppData\Local\Temp\pag. Grasso. prof. 21414969.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 664
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1240-58-0x0000000000000000-mapping.dmp
    Download
  • memory/1240-59-0x0000000002040000-0x0000000002041000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1684-55-0x0000000000860000-0x0000000000861000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1684-57-0x0000000004E30000-0x0000000004E31000-memory.dmp
    Filesize

    4KB

    Download