Analysis
-
max time kernel
127s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
16/08/2023, 07:08
General
-
Target
Satınalma Siparişi - 44965.exe
-
Size
655KB
-
MD5
0d6062a8c9a7aefeb01dc25894120e0f
-
SHA1
a28711aceaefa9deeae53689b0b9faf929cf6fb3
-
SHA256
e4b091b6eb1421a4bb8ef19af620e52d101806a44351c5191919198306d6b826
-
SHA512
ccd01a049cd4938a35457aaa7b0c7fe9750d9da2f79c98c4bb845006756947147f7179e4fabc49671212fc52a260b0c302262038e3f67eac2058bd92043d9f8b
-
SSDEEP
12288:PHUzAvAE5WGWxETOz7rn7bU1oUh05Y2hc4Dq5E8:szO54xETern7bUadY2Hq5E8
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Satınalma Siparişi - 44965.exe"C:\Users\Admin\AppData\Local\Temp\Satınalma Siparişi - 44965.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 10922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1608 -ip 16081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
7.7MB