Analysis
- max time kernel
124s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
01/12/2021, 08:44
General
- Target Досудебное требование.xll
- Size 556KB
- Sample211201-km7fnaeae8
- SHA256 03bbdb538b33b62be11ae0ee9b783d8d492bf0a3597176f81e8f11ccbd59fce3
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Досудебное требование.xll"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3512-118-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-119-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-120-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-121-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-122-0x0000000002D60000-0x0000000002D77000-memory.dmp
memory/3512-124-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-134-0x000000001B7F0000-0x000000001B826000-memory.dmp
memory/3512-135-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-136-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-138-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-139-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-140-0x0000000003090000-0x0000000003093000-memory.dmp
memory/3512-141-0x0000000001590000-0x0000000001592000-memory.dmp
memory/3512-150-0x0000000002FF3000-0x0000000002FF5000-memory.dmp
memory/3512-149-0x0000000002FF0000-0x0000000002FF2000-memory.dmp
memory/3512-151-0x0000000002FF6000-0x0000000002FF8000-memory.dmp
memory/3512-152-0x0000000002FF9000-0x0000000002FFB000-memory.dmp
memory/3512-153-0x0000000001590000-0x0000000001592000-memory.dmp