Analysis
-
max time kernel
152s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 18:54
General
-
Target
RFQ..exe
-
Size
363KB
-
MD5
976be92376c72a2c0c4927d2f0a13651
-
SHA1
c6b4a69ebd63382be533a9e2e4dc7c51e5c852d1
-
SHA256
d7bd54e41dbe29893e23fef937a9579c238abaf34196fb8905c3313192ed2393
-
SHA512
eb8bfcb357648cebf8116b744b064dfa05de0c97f8d5a38d24150a21792ef5e7de3d24133af97346fb66b4f58be423d21e5e868a7de8eafe14f345be3de3fd42
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ..exe"C:\Users\Admin\AppData\Local\Temp\RFQ..exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1628-130-0x0000000000200000-0x0000000000260000-memory.dmpFilesize
384KB
-
memory/1628-131-0x00000000051E0000-0x0000000005784000-memory.dmpFilesize
5.6MB
-
memory/1628-132-0x0000000004B50000-0x0000000004BE2000-memory.dmpFilesize
584KB
-
memory/1628-133-0x0000000004AD0000-0x0000000004ADA000-memory.dmpFilesize
40KB
-
memory/1628-134-0x0000000004E80000-0x0000000004F1C000-memory.dmpFilesize
624KB
-
memory/1628-135-0x0000000005020000-0x0000000005086000-memory.dmpFilesize
408KB