Analysis
- max time kernel
838s - max time network
840s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
08/06/2024, 07:56
General
- Target download.exe
- Size 88KB
- Sample240608-jsvtdabc43
- SHA256 40596da4af2b1b0387147484d112423d317e2fd41cd19bb1b63d2f8429bacee4
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1652 -s 5122⤵
-
-
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1652-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp
memory/1652-1-0x0000000000AE0000-0x0000000000AFC000-memory.dmp
memory/1652-2-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp
memory/1728-10-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp
memory/1728-9-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp
memory/1728-8-0x0000000001E70000-0x0000000001E78000-memory.dmp
memory/1728-7-0x000000001B5F0000-0x000000001B8D2000-memory.dmp
memory/1728-11-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp
memory/1728-12-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp
memory/1728-13-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp