Analysis
- max time kernel
91s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
23/05/2022, 13:21
General
- Target คำสั่ง.exe
- Size 818KB
- Sample220523-qlm9aadfa4
- SHA256 c08897a775845aeff123fd3d6fa4864dc8fe76935c634cdc0299cb3fbff2b922
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\คำสั่ง.exe"C:\Users\Admin\AppData\Local\Temp\คำสั่ง.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 13122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2612 -ip 26121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2612-130-0x00000000006B0000-0x0000000000782000-memory.dmp
memory/2612-131-0x00000000055F0000-0x0000000005B94000-memory.dmp
memory/2612-132-0x0000000005120000-0x00000000051B2000-memory.dmp
memory/2612-133-0x00000000052D0000-0x00000000052DA000-memory.dmp
memory/2612-134-0x0000000008A00000-0x0000000008A9C000-memory.dmp
memory/2612-135-0x0000000000CC0000-0x0000000000D26000-memory.dmp