Overview

overview

10

Static

static

PO 47295 y 47296.exe

windows7_x64

1

PO 47295 y 47296.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294179s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    23/03/2022, 13:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PO 47295 y 47296.exe
  • Size 1.1MB
  • Sample220323-q4rdnabecl
  • SHA256 190b1831c5dfcd818fb3a4ff19a5a0ebfdaec9598e71c7a8c9f56f6ac9e52c6f
  • MD5 SHA1 SHA512
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe
    "C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe
      "C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe"
      2⤵
        PID:336
      • C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe
        "C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe"
        2⤵
          PID:612
        • C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe
          "C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe"
          2⤵
            PID:808
          • C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe
            "C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe"
            2⤵
              PID:1968
            • C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe
              "C:\Users\Admin\AppData\Local\Temp\PO 47295 y 47296.exe"
              2⤵
                PID:1900

            Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  memory/960-54-0x0000000000370000-0x000000000048A000-memory.dmp
                  Download

                  memory/960-55-0x00000000002E0000-0x00000000002F8000-memory.dmp
                  Download

                  memory/960-56-0x00000000080B0000-0x00000000081A8000-memory.dmp
                  Download

                  memory/960-57-0x0000000000BA0000-0x0000000000BD0000-memory.dmp
                  Download