Analysis
- max time kernel
91s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/09/2022, 09:34
General
- Target RF202201002.exe
- Size 741KB
- Sample220929-ljsc1abdal
- SHA256 eb7562547f5d2ac7f6da17ec4c1e0195715ed4309ef43d5d0cc49ec073207ff5
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RF202201002.exe"C:\Users\Admin\AppData\Local\Temp\RF202201002.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 22042⤵
- Program crash
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4152 -ip 41521⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4152-132-0x0000000000840000-0x0000000000900000-memory.dmp
memory/4152-133-0x00000000058D0000-0x0000000005E74000-memory.dmp
memory/4152-134-0x0000000005320000-0x00000000053B2000-memory.dmp
memory/4152-135-0x00000000053C0000-0x000000000545C000-memory.dmp
memory/4152-136-0x00000000052A0000-0x00000000052AA000-memory.dmp