Analysis
- max time kernel
131s - max time network
157s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
30/01/2022, 15:15
General
- Target a50379d0e18b56fd13df8ff29681fe54efa1ca4d313930064fb3a30ea6148f84.exe
- Size 412KB
- Sample220130-smvqvsdfg3
- SHA256 a50379d0e18b56fd13df8ff29681fe54efa1ca4d313930064fb3a30ea6148f84
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a50379d0e18b56fd13df8ff29681fe54efa1ca4d313930064fb3a30ea6148f84.exe"C:\Users\Admin\AppData\Local\Temp\a50379d0e18b56fd13df8ff29681fe54efa1ca4d313930064fb3a30ea6148f84.exe"1⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 96722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3688-117-0x00000000009C0000-0x0000000000A2E000-memory.dmp
memory/3688-118-0x0000000005420000-0x0000000005421000-memory.dmp
memory/3688-119-0x0000000002BF0000-0x0000000002C12000-memory.dmp
memory/3688-120-0x00000000053D0000-0x00000000053F2000-memory.dmp
memory/3688-121-0x00000000053F0000-0x0000000005414000-memory.dmp
memory/3688-122-0x0000000007950000-0x00000000079E2000-memory.dmp
memory/3688-123-0x0000000007EF0000-0x00000000083EE000-memory.dmp
memory/3688-124-0x00000000079F0000-0x0000000007EEE000-memory.dmp