ee3eb8aff1a2ed730c158471e8f06b15dd572d649caf9bdd537bd5159f96bb3c | Triage

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 00:23

Sharing

Report Analysis Logs

General

Target

vol3-D..Users.Public.coms.exe
Size

782KB
MD5

2e4c47c36452522c07a184e742dc9e10
SHA1

39da9cfc163f54b08e4bdde8d1b7fd60198becaf
SHA256

ee3eb8aff1a2ed730c158471e8f06b15dd572d649caf9bdd537bd5159f96bb3c
SHA512

b299b6ca17b76039df0d6f5f4a68a07f7d9e9e7bec7307e80714710e1d362c3b2d9fde1b7f2ee2364fa2f8806003feeec2549cbe0ccd416b707a87cb87b31c47
SSDEEP

24576:yeiCrC5CdVAdf29jZc0D10zOEiBTOhMC:y2rCLVmjTsOBKJ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	vol3-D..Users.Public.coms.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	vol3-D..Users.Public.coms.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2032	1964	vol3-D..Users.Public.coms.exe	29
PID 1964 wrote to memory of 2032	1964	vol3-D..Users.Public.coms.exe	29
PID 1964 wrote to memory of 2032	1964	vol3-D..Users.Public.coms.exe	29

C:\Users\Admin\AppData\Local\Temp\vol3-D..Users.Public.coms.exe
"C:\Users\Admin\AppData\Local\Temp\vol3-D..Users.Public.coms.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 184
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads