Analysis
-
max time kernel
1790s -
max time network
1819s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 17:24
General
-
Target
all/gcs/encephalon_clean.exe
-
Size
4.8MB
-
MD5
21d07a078e78af8a4ccb30d0fc133ca5
-
SHA1
6f93f72e4b4b1219e0fe9b18192fd67b43666460
-
SHA256
5890b95051bdad9b5aa287265b64d85e61f26ca0368adc2f526959c660d77637
-
SHA512
dffb7351066d9ee99515a46c4612d420667b36a6f55e7aaf7b743e79ea4c76f041a9da711c5557a6439702630566db8fee3844f26969f4ecee771afb2d3d9838
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\all\gcs\encephalon_clean.exe"C:\Users\Admin\AppData\Local\Temp\all\gcs\encephalon_clean.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 268 -s 8922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-54-0x0000000000310000-0x0000000000A62000-memory.dmpFilesize
7.3MB
-
memory/268-55-0x000007FEF5A43000-0x000007FEF5A44000-memory.dmpFilesize
4KB
-
memory/268-59-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/268-58-0x000000001CBB0000-0x000000001CBB2000-memory.dmpFilesize
8KB
-
memory/268-60-0x0000000000270000-0x00000000002BE000-memory.dmpFilesize
312KB
-
memory/268-61-0x000000001B4F0000-0x000000001B582000-memory.dmpFilesize
584KB
-
memory/1104-62-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmpFilesize
8KB
-
memory/1104-63-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB