Overview

overview

10

Static

static

DOC29309.exe

windows7_x64

10

DOC29309.exe

windows10-2004_x64

6

DOC30039.exe

windows7_x64

10

DOC30039.exe

windows10-2004_x64

6

Analysis

  • max time kernel
    154s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 12:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DOC29309.exe

  • Size

    283KB

  • MD5

    92b37680ac5c24374bafb7db5be4fd0a

  • SHA1

    df08457d10f1ffea52d7115d5b0a498509e5a72a

  • SHA256

    f5ce2ee6334c46aae1d42e65626227232ca319a3a4c7e6388df99b0bc7da646e

  • SHA512

    4e05d6e3c0f7aa45de04c508db58476c9a7ab9a52fc6d9d59874193c8629b4bba3e430b6c1096fdd6952e794893699e2143fc0918e833ad1f92dacde9817d9fb

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DOC29309.exe
    "C:\Users\Admin\AppData\Local\Temp\DOC29309.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1572-130-0x0000000000830000-0x000000000087E000-memory.dmp
    Filesize

    312KB

    Download
  • memory/1572-131-0x00000000055C0000-0x0000000005B64000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/1572-132-0x0000000005100000-0x0000000005192000-memory.dmp
    Filesize

    584KB

    Download
  • memory/1572-133-0x00000000050F0000-0x00000000050FA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1572-134-0x00000000054A0000-0x000000000553C000-memory.dmp
    Filesize

    624KB

    Download
  • memory/1572-135-0x0000000005540000-0x00000000055A6000-memory.dmp
    Filesize

    408KB

    Download