Analysis
-
max time kernel
127s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 01:27
General
-
Target
ödenmiş fatura.exe
-
Size
700.6MB
-
MD5
87b6dca2969d1aa7dbb4c6a75d9bad5a
-
SHA1
5f02ef0d54e574983a4a61a05bf029865236fbeb
-
SHA256
af389051a5dda1eb9ff6389ad08d019a3ad1e5dfc91de75ce2d67a43da3b9191
-
SHA512
e25193685fa000f83a9deae9114b27d89cf2682134d5e2720a257790925289aba3932277bc3e379e505fe3a8c9be8397aa33a804650b58378d62b23318b72957
-
SSDEEP
12288:Afg3r+1v1RWLm+D7Vqh/v5XpKJzwAPNhvwmmtLWPAuQ7Wdqid1uKozg5vH:AfkUvd+Dpg/v5+cAlhv9mpFWdqEoUFH
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ödenmiş fatura.exe"C:\Users\Admin\AppData\Local\Temp\ödenmiş fatura.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 11762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4936 -ip 49361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
424KB
-
Filesize
624KB
-
Filesize
200KB
-
Filesize
7.7MB