98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc | Triage

Resubmissions

28-05-2024 08:39

240528-kklq6scg8y 10

26-05-2024 17:22

240526-vxlxtaef89 10

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 08:39

Sharing

Report Analysis Logs

General

Target

New Text Document.exe
Size

4KB
MD5

a239a27c2169af388d4f5be6b52f272c
SHA1

0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c
SHA256

98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
SHA512

f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da
SSDEEP

48:6r1huik0xzYGJZZJOQOulbfSqXSfbNtm:IIxcLpf6zNt

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

New Text Document.exe

description pid process

Token: SeDebugPrivilege 856 New Text Document.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

New Text Document.exe

description	pid	process	target process
PID 856 wrote to memory of 2744	856	New Text Document.exe	WerFault.exe
PID 856 wrote to memory of 2744	856	New Text Document.exe	WerFault.exe
PID 856 wrote to memory of 2744	856	New Text Document.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\New Text Document.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 856 -s 1076
2⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/856-1-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/856-2-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/856-3-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download