Analysis
-
max time kernel
4294182s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
15-03-2022 08:44
Static task
static1
Behavioral task
behavioral1
Sample
Lista narudzbi u prilogu.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
General
-
Target
Lista narudzbi u prilogu.exe
-
Size
683KB
-
MD5
5879dcb6632d8c3d53f39a29e86cdcce
-
SHA1
97c358a006711c52a4647c3db520a9fdb575e952
-
SHA256
a84bdf209b862ffbdf3d963611eec3c1c2d70024e24041727a49bc618d6ff4cd
-
SHA512
80778f7cfdea1f20b8a44a4633558dfc22475cadeb54b9477cb739d59f85c70a26b8b9dab84c62347d719438849cb91ef0da8de174af022c09b87d2a06c6d4eb
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Lista narudzbi u prilogu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pgkotdp = "C:\\Users\\Public\\pdtokgP.url" Lista narudzbi u prilogu.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1632 1912 WerFault.exe DpiScaling.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Lista narudzbi u prilogu.exeDpiScaling.exedescription pid process target process PID 1568 wrote to memory of 1912 1568 Lista narudzbi u prilogu.exe DpiScaling.exe PID 1568 wrote to memory of 1912 1568 Lista narudzbi u prilogu.exe DpiScaling.exe PID 1568 wrote to memory of 1912 1568 Lista narudzbi u prilogu.exe DpiScaling.exe PID 1568 wrote to memory of 1912 1568 Lista narudzbi u prilogu.exe DpiScaling.exe PID 1568 wrote to memory of 1912 1568 Lista narudzbi u prilogu.exe DpiScaling.exe PID 1568 wrote to memory of 1912 1568 Lista narudzbi u prilogu.exe DpiScaling.exe PID 1568 wrote to memory of 1912 1568 Lista narudzbi u prilogu.exe DpiScaling.exe PID 1912 wrote to memory of 1632 1912 DpiScaling.exe WerFault.exe PID 1912 wrote to memory of 1632 1912 DpiScaling.exe WerFault.exe PID 1912 wrote to memory of 1632 1912 DpiScaling.exe WerFault.exe PID 1912 wrote to memory of 1632 1912 DpiScaling.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lista narudzbi u prilogu.exe"C:\Users\Admin\AppData\Local\Temp\Lista narudzbi u prilogu.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 1563⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1568-54-0x0000000075421000-0x0000000075423000-memory.dmpFilesize
8KB
-
memory/1568-55-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1912-58-0x0000000072480000-0x00000000724AE000-memory.dmpFilesize
184KB
-
memory/1912-60-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB