Overview

overview

10

Static

static

Project AC...g).exe

windows7_x64

3

Project AC...g).exe

windows10_x64

10

Analysis

  • max time kernel
    300s
  • max time network
    300s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    03-12-2021 15:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Project AC (Minutes of meeting).exe

  • Size

    476KB

  • MD5

    0a3a1385c70ecec991de3baf9ea504e8

  • SHA1

    86816fa13e9cba505c8566460d40d83d38e8d0aa

  • SHA256

    bc1c5068758bf788a3e39e19e6eb76d8cc3600b1c7cc0e710cf960a9e7cf3f1c

  • SHA512

    ec7a49086923aaf1abc01f1a83416c112b8465d852eaf907e459e8f5c0d25a31c9a15632317b1e3408a19dacd8ed9f5d7614a8bca1e7ee9bd2e135b92c407569

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Project AC (Minutes of meeting).exe
    "C:\Users\Admin\AppData\Local\Temp\Project AC (Minutes of meeting).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 664
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/768-55-0x0000000001020000-0x0000000001021000-memory.dmp
    Filesize

    4KB

    Download
  • memory/768-57-0x0000000075A01000-0x0000000075A03000-memory.dmp
    Filesize

    8KB

    Download
  • memory/768-58-0x0000000000540000-0x0000000000548000-memory.dmp
    Filesize

    32KB

    Download
  • memory/768-59-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/768-60-0x0000000005080000-0x00000000050E9000-memory.dmp
    Filesize

    420KB

    Download
  • memory/1664-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1664-62-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
    Filesize

    4KB

    Download