Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
26-02-2023 01:37
General
-
Target
37b659aa22473d3c2c8d94a2f83735a3e849fa148955401751e9a28963171320.exe
-
Size
582KB
-
MD5
be7fb27a2d8fe2dcb1573590373ccab7
-
SHA1
1f97541db03a96f28c786e99ee40d8da1a2035fd
-
SHA256
37b659aa22473d3c2c8d94a2f83735a3e849fa148955401751e9a28963171320
-
SHA512
209d24bb976d671755bf3cdfffdc9d28d2f7c2fd372d3dd6e1a2fdcb537a50ddfd296a661b3627652d945317b0c211d46b569235897a010bac77aea97de28605
-
SSDEEP
12288:Ha4ne0dXFMetm3aC33ZLJLUf9snBS4csPYae6qfzFAA:T5I33hhUF54clNf7FB
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37b659aa22473d3c2c8d94a2f83735a3e849fa148955401751e9a28963171320.exe"C:\Users\Admin\AppData\Local\Temp\37b659aa22473d3c2c8d94a2f83735a3e849fa148955401751e9a28963171320.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2024 -s 13322⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608KB
-
Filesize
512KB