Analysis
- max time kernel
138s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
29/05/2023, 22:38
General
- Target GhostCosmeticsFree-Visenya.exe
- Size 8.0MB
- Sample230529-2kkmjsec2t
- SHA256 80b2cdf1cb0b71fb27e7b1f5ec8d473a31d78a9435992916561fd9a4107e6f75
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GhostCosmeticsFree-Visenya.exe"C:\Users\Admin\AppData\Local\Temp\GhostCosmeticsFree-Visenya.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 10842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4644 -ip 46441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4644-133-0x0000000000310000-0x0000000000B0C000-memory.dmp
memory/4644-134-0x0000000005380000-0x0000000005390000-memory.dmp
memory/4644-135-0x0000000005BF0000-0x0000000006194000-memory.dmp
memory/4644-136-0x0000000005640000-0x00000000056D2000-memory.dmp
memory/4644-137-0x00000000053F0000-0x00000000053FA000-memory.dmp