Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
13/09/2024, 12:03
General
- Target Tpnit.exe
- Size 959KB
- Sample240913-n7116a1ara
- SHA256 f5b1deb060982e05d98c940ebf0b8d50cef95922fab5fed5ed8c2a9d7acdda80
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tpnit.exe"C:\Users\Admin\AppData\Local\Temp\Tpnit.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2276 -s 6082⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2276-0-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp
memory/2276-1-0x0000000001380000-0x0000000001474000-memory.dmp
memory/2276-2-0x000000001AAC0000-0x000000001ABA6000-memory.dmp
memory/2276-3-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp
memory/2276-4-0x000000001AFE0000-0x000000001B0C6000-memory.dmp
memory/2276-5-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-6-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-8-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-32-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-10-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-56-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-12-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-68-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-14-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-16-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-18-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-66-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-64-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-62-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-60-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-58-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-54-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-52-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-50-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-48-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-46-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-44-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-42-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-40-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-38-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-36-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-34-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-30-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-28-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-26-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-24-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-22-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-20-0x000000001AFE0000-0x000000001B0C1000-memory.dmp
memory/2276-1079-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp
memory/2276-1080-0x0000000000620000-0x0000000000682000-memory.dmp
memory/2276-1081-0x0000000000B40000-0x0000000000B8C000-memory.dmp
memory/2276-1082-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp
memory/2276-1083-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp
memory/2276-1085-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp
memory/2276-1086-0x0000000000360000-0x00000000003B4000-memory.dmp
memory/2276-1088-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp