293ba40b1cb108c5d5f6f069bafe89cfbf1e970efaf82020dbf25992102948a0

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LETTER-PROFORMA-APPOINTMENT-DOCX.exe
Size

695KB
MD5

dc5efebad778fed9a844ef6faef4d156
SHA1

0708cdc4ebb6225dfe99b4dee80a2513760583ab
SHA256

293ba40b1cb108c5d5f6f069bafe89cfbf1e970efaf82020dbf25992102948a0
SHA512

9e371d298c345fc7333ff6eea8720fbb3c05e76718197d44068cdcaec09f5c79abed709f9381222cdc25f57b4ea72086bad83297ce7cc9529538105a15d0a2e7
SSDEEP

12288:vNi8LkpEa+4hzx/HQZaJSDQOk8mekzq7R0N5wJRHT41OIm2/lzXMz5I1ntc3DZ2M:AjEI/HgaJSnZOzvuHT4oIN5ei1n4n

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

LETTER-PROFORMA-APPOINTMENT-DOCX.exe

description pid process target process

PID 1544 set thread context of 2916 1544 LETTER-PROFORMA-APPOINTMENT-DOCX.exe LETTER-PROFORMA-APPOINTMENT-DOCX.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2340 2916 WerFault.exe LETTER-PROFORMA-APPOINTMENT-DOCX.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

LETTER-PROFORMA-APPOINTMENT-DOCX.exeLETTER-PROFORMA-APPOINTMENT-DOCX.exe

pid process

1544 LETTER-PROFORMA-APPOINTMENT-DOCX.exe
2916 LETTER-PROFORMA-APPOINTMENT-DOCX.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

LETTER-PROFORMA-APPOINTMENT-DOCX.exe

description pid process

Token: SeDebugPrivilege 1544 LETTER-PROFORMA-APPOINTMENT-DOCX.exe

description	pid	process	target process
PID 1544 set thread context of 2916	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe

pid	pid_target	process	target process
2340	2916	WerFault.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe

pid	process
1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
2916	LETTER-PROFORMA-APPOINTMENT-DOCX.exe

description	pid	process
Token: SeDebugPrivilege	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

LETTER-PROFORMA-APPOINTMENT-DOCX.exeLETTER-PROFORMA-APPOINTMENT-DOCX.exe

C:\Users\Admin\AppData\Local\Temp\LETTER-PROFORMA-APPOINTMENT-DOCX.exe
"C:\Users\Admin\AppData\Local\Temp\LETTER-PROFORMA-APPOINTMENT-DOCX.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\LETTER-PROFORMA-APPOINTMENT-DOCX.exe
"C:\Users\Admin\AppData\Local\Temp\LETTER-PROFORMA-APPOINTMENT-DOCX.exe"
2⤵
PID:2108

C:\Users\Admin\AppData\Local\Temp\LETTER-PROFORMA-APPOINTMENT-DOCX.exe
"C:\Users\Admin\AppData\Local\Temp\LETTER-PROFORMA-APPOINTMENT-DOCX.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 36
3⤵
- Program crash
PID:2340

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-14-0x0000000074AB0000-0x000000007519E000-memory.dmp

Filesize
6.9MB

Download
memory/1544-1-0x0000000000300000-0x00000000003B4000-memory.dmp

Filesize
720KB

Download
memory/1544-2-0x0000000074AB0000-0x000000007519E000-memory.dmp

Filesize
6.9MB

Download
memory/1544-3-0x00000000006A0000-0x00000000006BA000-memory.dmp

Filesize
104KB

Download
memory/1544-4-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/1544-5-0x00000000053F0000-0x000000000547A000-memory.dmp

Filesize
552KB

Download
memory/1544-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

Filesize
4KB

Download
memory/2916-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2916-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2916-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2916-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2916-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2916-16-0x0000000000A30000-0x0000000000D33000-memory.dmp

Filesize
3.0MB

Download

description	pid	process	target process
PID 1544 wrote to memory of 2108	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2108	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2108	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2108	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2916	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2916	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2916	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2916	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2916	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2916	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 1544 wrote to memory of 2916	1544	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	LETTER-PROFORMA-APPOINTMENT-DOCX.exe
PID 2916 wrote to memory of 2340	2916	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	WerFault.exe
PID 2916 wrote to memory of 2340	2916	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	WerFault.exe
PID 2916 wrote to memory of 2340	2916	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	WerFault.exe
PID 2916 wrote to memory of 2340	2916	LETTER-PROFORMA-APPOINTMENT-DOCX.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads