Analysis

  • max time kernel
    326s
  • max time network
    356s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    02-05-2022 14:14

General

  • Target

    Video.mp4.scr

  • Size

    700MB

  • MD5

    403fc6029a35c21a7d31d657cec40f0a

  • SHA1

    f669ea4ffe545d76eb329dfd10e3fe6145e0950d

  • SHA256

    30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb

  • SHA512

    37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843

Score
1/10

Malware Config

Signatures 3

  • Suspicious behavior: EnumeratesProcesses ⋅ 20 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 40 IoCs

Processes 11

  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
    "C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:692
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:456
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:1204
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:1680
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:1448
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:776
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:1300
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:336
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:548
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:524
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:436

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/692-54-0x0000000000330000-0x00000000004B6000-memory.dmp
                          • memory/692-55-0x00000000751C1000-0x00000000751C3000-memory.dmp
                          • memory/692-56-0x0000000005D30000-0x0000000005E84000-memory.dmp
                          • memory/692-57-0x0000000008190000-0x00000000082E6000-memory.dmp
                          • memory/692-58-0x0000000004E10000-0x0000000004E46000-memory.dmp