Analysis
- max time kernel
144s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/05/2022, 01:43
General
- Target PO0058-02702020.exe
- Size 568KB
- Sample220521-b5jymsgahp
- SHA256 ae02063e5b0d9b107879b58b227adfe48eae5be7836975405403a6aa03598dcc
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO0058-02702020.exe"C:\Users\Admin\AppData\Local\Temp\PO0058-02702020.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\PO0058-02702020.exe' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\PO0058-02702020.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1904-130-0x00000000006E0000-0x0000000000774000-memory.dmp
memory/1904-131-0x00000000057F0000-0x0000000005D94000-memory.dmp
memory/1904-132-0x00000000053E0000-0x0000000005472000-memory.dmp
memory/1904-133-0x00000000053C0000-0x00000000053CA000-memory.dmp
memory/1904-134-0x0000000007FF0000-0x000000000808C000-memory.dmp
memory/1904-135-0x0000000008180000-0x00000000081E6000-memory.dmp
memory/5048-138-0x0000000004FE0000-0x0000000005016000-memory.dmp
memory/5048-139-0x00000000057C0000-0x0000000005DE8000-memory.dmp
memory/5048-140-0x0000000005DF0000-0x0000000005E12000-memory.dmp
memory/5048-141-0x0000000005E90000-0x0000000005EF6000-memory.dmp
memory/5048-142-0x0000000006590000-0x00000000065AE000-memory.dmp
memory/5048-143-0x0000000007D50000-0x00000000083CA000-memory.dmp
memory/5048-144-0x0000000006A90000-0x0000000006AAA000-memory.dmp
memory/5048-145-0x00000000077B0000-0x0000000007846000-memory.dmp
memory/5048-146-0x0000000007710000-0x0000000007732000-memory.dmp