Analysis
- max time kernel
16s - max time network
17s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
17/10/2024, 18:07
General
- Target f53ac28e9b0ec8535333795ab9e0e52b17a77ad5eabc7b5172bd7e7aac41df12.exe
- Size 120KB
- Sample241017-wqa3ea1cpm
- SHA256 f53ac28e9b0ec8535333795ab9e0e52b17a77ad5eabc7b5172bd7e7aac41df12
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f53ac28e9b0ec8535333795ab9e0e52b17a77ad5eabc7b5172bd7e7aac41df12.exe"C:\Users\Admin\AppData\Local\Temp\f53ac28e9b0ec8535333795ab9e0e52b17a77ad5eabc7b5172bd7e7aac41df12.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1756 -s 11922⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1756-0-0x000007FEF5743000-0x000007FEF5744000-memory.dmp
memory/1756-1-0x0000000001210000-0x0000000001234000-memory.dmp
memory/1756-3-0x000007FEF5740000-0x000007FEF612C000-memory.dmp
memory/1756-41-0x000007FEF5740000-0x000007FEF612C000-memory.dmp