Analysis
- max time kernel
146s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
27/05/2024, 19:08
General
- Target Comet 3 Alpha 11.1/Comet 3.exe
- Size 6.8MB
- Sample240527-xtklpaff76
- SHA256 5638a3b01c795ac3499aba57af7a78b7cb53a8acb653cf1185de3694df1e617d
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Comet 3 Alpha 11.1\Comet 3.exe"C:\Users\Admin\AppData\Local\Temp\Comet 3 Alpha 11.1\Comet 3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 18922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3240 -ip 32401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3240-0-0x00000000745CE000-0x00000000745CF000-memory.dmp
memory/3240-1-0x0000000000B90000-0x0000000001258000-memory.dmp
memory/3240-2-0x00000000745C0000-0x0000000074D71000-memory.dmp
memory/3240-3-0x00000000081B0000-0x0000000008A9C000-memory.dmp
memory/3240-4-0x0000000006E30000-0x0000000006EE2000-memory.dmp
memory/3240-5-0x0000000009140000-0x00000000096E6000-memory.dmp
memory/3240-6-0x0000000008C10000-0x0000000008C86000-memory.dmp
memory/3240-7-0x00000000745C0000-0x0000000074D71000-memory.dmp