8061734fd0c8bfb3edf02e6026115b0bf55ba719a3f389abad4e81c4598d168e | Triage

Analysis

max time kernel
300s
max time network
300s
platform
windows7_x64
resource
win7-en-20211014
submitted
02-12-2021 12:48

Sharing

Report Analysis Logs

General

Target

NEW APPSUILT2.exe
Size

215KB
MD5

057c210911045f8f4a62ff3cacc31829
SHA1

8f779ff6231c764901c16e688bc44aba69acb5f5
SHA256

e278e44869b4560ae8cab37e0d71ef79ede0f73a5b4176ce04db3c2818cec336
SHA512

f6c55d0440e3a8b6614ddf4b0ae218d01ae283c58fae6eaafb90be74b8edbc1bb685169a5139f21c638290b1241078237ec356ea472113c6e8889f092f1500ff

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

NEW APPSUILT2.exe

pid process

1116 NEW APPSUILT2.exe
1116 NEW APPSUILT2.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1124 dw20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEW APPSUILT2.exe

description pid process

Token: SeDebugPrivilege 1116 NEW APPSUILT2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

NEW APPSUILT2.exe

description	pid	process	target process
PID 1116 wrote to memory of 1124	1116	NEW APPSUILT2.exe	dw20.exe
PID 1116 wrote to memory of 1124	1116	NEW APPSUILT2.exe	dw20.exe
PID 1116 wrote to memory of 1124	1116	NEW APPSUILT2.exe	dw20.exe
PID 1116 wrote to memory of 1124	1116	NEW APPSUILT2.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\NEW APPSUILT2.exe
"C:\Users\Admin\AppData\Local\Temp\NEW APPSUILT2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 516
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1124

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1116-56-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1124-57-0x0000000000000000-mapping.dmp

Download
memory/1124-59-0x0000000001D10000-0x0000000001D11000-memory.dmp

Filesize
4KB

Download