Overview

overview

10

Static

static

56cd5749a3...b2.exe

windows7_x64

10

56cd5749a3...b2.exe

windows10-2004_x64

6

Analysis

  • max time kernel
    130s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16-05-2022 12:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe

  • Size

    23KB

  • MD5

    9f5f2fc905270a6f6c952c52f9b438b9

  • SHA1

    66386b1e39842a9f843183829e8546fc82a61b16

  • SHA256

    56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2

  • SHA512

    ea8d3d1937cfdd010b1ac6831eb7c77f32db2cf30eeb25919f7de1124f44eb7e07ef7a662ca33af63628b6405b1497dbc067673e6602793971a79adb85d231a6

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe
    "C:\Users\Admin\AppData\Local\Temp\56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1360
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 1696
      2⤵
      • Program crash
      PID:880
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1360 -ip 1360
    1⤵
      PID:2656

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Web Service

    1
    T1102

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1360-130-0x00000000005F0000-0x00000000005FC000-memory.dmp
      Filesize

      48KB

      Download
    • memory/1360-131-0x0000000004F60000-0x0000000004FFC000-memory.dmp
      Filesize

      624KB

      Download