Analysis
- max time kernel
146s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
09/03/2023, 08:33
General
- Target Quotation_비밀유지서약서.exe
- Size 859KB
- Sample230309-kfy6psbd69
- SHA256 1ca3575bdfb30ebbb970d00611808d9de9816763aa135d2e22a5b208cd4d3b23
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation_비밀유지서약서.exe"C:\Users\Admin\AppData\Local\Temp\Quotation_비밀유지서약서.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 11562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3528 -ip 35281⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3528-133-0x0000000000860000-0x000000000093C000-memory.dmp
memory/3528-134-0x00000000057E0000-0x0000000005D84000-memory.dmp
memory/3528-135-0x00000000052D0000-0x0000000005362000-memory.dmp
memory/3528-136-0x0000000005380000-0x000000000538A000-memory.dmp
memory/3528-137-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/3528-138-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/3528-139-0x0000000006DA0000-0x0000000006E3C000-memory.dmp