Overview

overview

10

Static

static

DATA PROTE...32.dll

windows7_x64

1

DATA PROTE...32.dll

windows10-2004_x64

1

DATA PROTE...se.dll

windows7_x64

1

DATA PROTE...se.dll

windows10-2004_x64

1

DATA PROTE...l3.dll

windows7_x64

1

DATA PROTE...l3.dll

windows10-2004_x64

1

Video.mp4.scr

windows7_x64

1

Video.mp4.scr

windows10-2004_x64

10

Analysis

  • max time kernel
    38s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    05-07-2022 17:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Video.mp4.scr

  • Size

    700.0MB

  • MD5

    403fc6029a35c21a7d31d657cec40f0a

  • SHA1

    f669ea4ffe545d76eb329dfd10e3fe6145e0950d

  • SHA256

    30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb

  • SHA512

    37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
    "C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1872
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      2⤵
        PID:1304
      • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
        C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
        2⤵
          PID:1724
        • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
          C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
          2⤵
            PID:1288
          • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
            C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
            2⤵
              PID:1400
            • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
              C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
              2⤵
                PID:1060
              • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                2⤵
                  PID:1284
                • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                  C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                  2⤵
                    PID:1092
                  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                    C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                    2⤵
                      PID:948
                    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                      2⤵
                        PID:956
                      • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                        C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
                        2⤵
                          PID:1196

                      Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/1872-54-0x00000000002A0000-0x0000000000426000-memory.dmp
                        Filesize

                        1.5MB

                        Download
                      • memory/1872-55-0x0000000076461000-0x0000000076463000-memory.dmp
                        Filesize

                        8KB

                        Download
                      • memory/1872-56-0x0000000005BB0000-0x0000000005D04000-memory.dmp
                        Filesize

                        1.3MB

                        Download
                      • memory/1872-57-0x0000000005E70000-0x0000000005FC6000-memory.dmp
                        Filesize

                        1.3MB

                        Download
                      • memory/1872-58-0x00000000044B0000-0x00000000044E6000-memory.dmp
                        Filesize

                        216KB

                        Download