Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
02-12-2021 10:30
Static task
static1
Behavioral task
behavioral1
Sample
NEW APPSUILT2.exe
Resource
win7-en-20211104
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NEW APPSUILT2.exe
Resource
win10-en-20211104
0 signatures
0 seconds
General
-
Target
NEW APPSUILT2.exe
-
Size
215KB
-
MD5
057c210911045f8f4a62ff3cacc31829
-
SHA1
8f779ff6231c764901c16e688bc44aba69acb5f5
-
SHA256
e278e44869b4560ae8cab37e0d71ef79ede0f73a5b4176ce04db3c2818cec336
-
SHA512
f6c55d0440e3a8b6614ddf4b0ae218d01ae283c58fae6eaafb90be74b8edbc1bb685169a5139f21c638290b1241078237ec356ea472113c6e8889f092f1500ff
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
NEW APPSUILT2.exepid process 1456 NEW APPSUILT2.exe 1456 NEW APPSUILT2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 1048 dw20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEW APPSUILT2.exedescription pid process Token: SeDebugPrivilege 1456 NEW APPSUILT2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
NEW APPSUILT2.exedescription pid process target process PID 1456 wrote to memory of 1048 1456 NEW APPSUILT2.exe dw20.exe PID 1456 wrote to memory of 1048 1456 NEW APPSUILT2.exe dw20.exe PID 1456 wrote to memory of 1048 1456 NEW APPSUILT2.exe dw20.exe PID 1456 wrote to memory of 1048 1456 NEW APPSUILT2.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW APPSUILT2.exe"C:\Users\Admin\AppData\Local\Temp\NEW APPSUILT2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5162⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-57-0x0000000000000000-mapping.dmp
-
memory/1048-59-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB
-
memory/1456-55-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1456-56-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB