Analysis
-
max time kernel
136s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 03:40
General
-
Target
7f5150f3f8c7d4ddc347145febe6298261cd3202cccb13eae92b3bb5d1f51aad.exe
-
Size
733KB
-
MD5
670c1c408f78531edb204032e6ec1d9a
-
SHA1
cf349c4cc53c3b77ac4f7fecdfe892c3ca685f38
-
SHA256
7f5150f3f8c7d4ddc347145febe6298261cd3202cccb13eae92b3bb5d1f51aad
-
SHA512
db786392d6f470c23459ad793fb2ac5637a973aee1a27984e0a91f4721635017555a7409786cd85ed1604171a4fa8ce812f88d156468e006658d4edc83151f48
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f5150f3f8c7d4ddc347145febe6298261cd3202cccb13eae92b3bb5d1f51aad.exe"C:\Users\Admin\AppData\Local\Temp\7f5150f3f8c7d4ddc347145febe6298261cd3202cccb13eae92b3bb5d1f51aad.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1468 -s 13842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
-
Filesize
472KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
9.6MB