Overview
overview
10Static
static
DATA PROTE...32.dll
windows7_x64
1DATA PROTE...32.dll
windows10-2004_x64
1DATA PROTE...se.dll
windows7_x64
1DATA PROTE...se.dll
windows10-2004_x64
1DATA PROTE...l3.dll
windows7_x64
1DATA PROTE...l3.dll
windows10-2004_x64
1Video.mp4.scr
windows7_x64
1Video.mp4.scr
windows10-2004_x64
10Analysis
-
max time kernel
326s -
max time network
356s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 14:14
Static task
static1
Behavioral task
behavioral1
Sample
DATA PROTECTION/advapi32.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DATA PROTECTION/advapi32.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
DATA PROTECTION/combase.dll
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
DATA PROTECTION/combase.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
DATA PROTECTION/freebl3.dll
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
DATA PROTECTION/freebl3.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
Video.mp4.scr
Resource
win7-20220414-en
General
-
Target
Video.mp4.scr
-
Size
700MB
-
MD5
403fc6029a35c21a7d31d657cec40f0a
-
SHA1
f669ea4ffe545d76eb329dfd10e3fe6145e0950d
-
SHA256
30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb
-
SHA512
37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Video.mp4.scrpid process 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr 692 Video.mp4.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Video.mp4.scrdescription pid process Token: SeDebugPrivilege 692 Video.mp4.scr -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
Video.mp4.scrdescription pid process target process PID 692 wrote to memory of 436 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 436 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 436 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 436 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 524 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 524 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 524 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 524 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 548 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 548 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 548 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 548 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 336 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 336 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 336 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 336 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1300 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1300 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1300 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1300 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 456 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 456 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 456 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 456 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 776 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 776 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 776 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 776 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1204 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1204 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1204 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1204 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1448 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1448 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1448 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1448 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1680 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1680 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1680 692 Video.mp4.scr Video.mp4.scr PID 692 wrote to memory of 1680 692 Video.mp4.scr Video.mp4.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr"C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/692-54-0x0000000000330000-0x00000000004B6000-memory.dmpFilesize
1MB
-
memory/692-55-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB
-
memory/692-56-0x0000000005D30000-0x0000000005E84000-memory.dmpFilesize
1MB
-
memory/692-57-0x0000000008190000-0x00000000082E6000-memory.dmpFilesize
1MB
-
memory/692-58-0x0000000004E10000-0x0000000004E46000-memory.dmpFilesize
216KB