Analysis

  • max time kernel
    121s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    29-11-2021 09:51

General

  • Target

    b827a7d4b3614a9c47fe79aefcc616cc4bcbec91.exe

  • Size

    818KB

  • MD5

    9a50d2d0bafd2166fcb2ac5b9e3f45c0

  • SHA1

    b827a7d4b3614a9c47fe79aefcc616cc4bcbec91

  • SHA256

    28528e3099b98259f3967fab3b23d5dd17588d3bf1d99f02e20d324eab368735

  • SHA512

    86e559b3b381c39025aac64faedc706b28d47b4673115c392a2d39b0d21e4759045e8fe911e165a4b5b3b8699d4867634342f7af14b43285fc5bc0c6f97a65e1

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b827a7d4b3614a9c47fe79aefcc616cc4bcbec91.exe
    "C:\Users\Admin\AppData\Local\Temp\b827a7d4b3614a9c47fe79aefcc616cc4bcbec91.exe"
    1⤵
    • Adds Run key to start application
    PID:3476
    • C:\Windows\SysWOW64\logagent.exe
      C:\Windows\System32\logagent.exe
      2⤵
        PID:4492
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 1944
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:764

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3476-118-0x00000000006C0000-0x00000000006C1000-memory.dmp
      Filesize

      4KB

    • memory/3476-119-0x00000000028D1000-0x00000000028E2000-memory.dmp
      Filesize

      68KB

    • memory/3476-120-0x00000000028E2000-0x00000000028E3000-memory.dmp
      Filesize

      4KB