Analysis

  • max time kernel
    124s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    29-11-2021 14:50

General

  • Target

    Urdhri i bashkangjitur.exe

  • Size

    818KB

  • MD5

    9a50d2d0bafd2166fcb2ac5b9e3f45c0

  • SHA1

    b827a7d4b3614a9c47fe79aefcc616cc4bcbec91

  • SHA256

    28528e3099b98259f3967fab3b23d5dd17588d3bf1d99f02e20d324eab368735

  • SHA512

    86e559b3b381c39025aac64faedc706b28d47b4673115c392a2d39b0d21e4759045e8fe911e165a4b5b3b8699d4867634342f7af14b43285fc5bc0c6f97a65e1

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Urdhri i bashkangjitur.exe
    "C:\Users\Admin\AppData\Local\Temp\Urdhri i bashkangjitur.exe"
    1⤵
    • Adds Run key to start application
    PID:4080
    • C:\Windows\SysWOW64\logagent.exe
      C:\Windows\System32\logagent.exe
      2⤵
        PID:2376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1892
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1164

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4080-118-0x0000000002381000-0x0000000002392000-memory.dmp
      Filesize

      68KB

    • memory/4080-119-0x0000000002392000-0x0000000002393000-memory.dmp
      Filesize

      4KB

    • memory/4080-120-0x0000000002340000-0x0000000002341000-memory.dmp
      Filesize

      4KB