Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-10-2024 15:01
General
-
Target
Qaovmgmn.exe
-
Size
1.1MB
-
MD5
2fcc31707bfa6f3b9a82ef482e81f08f
-
SHA1
f820b95c7e9d10d951c3d48c2b491b64ed274534
-
SHA256
6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0
-
SHA512
1cfa47e1a602467386b11f86a67252046cad119f378c2f09362efe60c7a9ce8e6ba26dd452d87e9dd6f7c1de00682a986495f4ec3708c15440441592a65fcbb9
-
SSDEEP
24576:Pt4rexG2D35fmUw5UpCZI3M3xr7KT8LwcCouwvxA688j:V4rexG2D3nw6pCZyMhvKrrTQxAl8j
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Qaovmgmn.exe"C:\Users\Admin\AppData\Local\Temp\Qaovmgmn.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2704 -s 5922⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
952KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
9.9MB
-
Filesize
392KB
-
Filesize
9.9MB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB