Analysis
- max time kernel
93s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
29/01/2024, 18:04
General
- Target rYENİSİPARİŞSoysalpeugeotRFQ27014202GREECE.exe
- Size 716KB
- Sample240129-wnk5laffe7
- SHA256 2288a6cd829317786fbf8c7cbbc225457b84cd39ad59010d33dc2669199dedd9
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rYENİSİPARİŞSoysalpeugeotRFQ27014202GREECE.exe"C:\Users\Admin\AppData\Local\Temp\rYENİSİPARİŞSoysalpeugeotRFQ27014202GREECE.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 12122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2636 -ip 26361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2636-1-0x0000000074670000-0x0000000074E20000-memory.dmp
memory/2636-2-0x0000000005700000-0x0000000005CA4000-memory.dmp
memory/2636-0-0x00000000005D0000-0x0000000000686000-memory.dmp
memory/2636-3-0x0000000005150000-0x00000000051E2000-memory.dmp
memory/2636-4-0x0000000005090000-0x00000000050A0000-memory.dmp
memory/2636-5-0x0000000002B20000-0x0000000002B2A000-memory.dmp
memory/2636-6-0x0000000005220000-0x000000000523C000-memory.dmp
memory/2636-7-0x0000000005250000-0x0000000005264000-memory.dmp
memory/2636-9-0x000000000A520000-0x000000000A5BC000-memory.dmp
memory/2636-8-0x0000000007DA0000-0x0000000007E22000-memory.dmp
memory/2636-10-0x0000000074670000-0x0000000074E20000-memory.dmp