99708cebaf8533fccab62718d43c6c1cdfdcb48640c423306a894dfbdc519b85

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-01-2025 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Document desription.exe
Size

1.3MB
MD5

42e5f44b46f5a582a85829236ba2c2c8
SHA1

d733b18d85baead3612710bbd7965f17f96b22c4
SHA256

6f5273caf722986c373fd330354161fa8140201f41b0edec092700ab2ed463e3
SHA512

70ad0cd995d1fc3602190d27c0f53a17e4c342d270998205f69c1e9b3cebf019d45e312542a852ac0921bff41a9b5584d4d8d36543712fe0c7507644134daad7
SSDEEP

24576:aQejQy4n+DF3BwDEXWxCVsdRG9zGE5jDkyY7abKv35NXGbEJOa7lgE:dAQy4duWxKsd49z9jS7rGUZ

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs	Document desription.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	Document desription.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	Document desription.exe
Token: SeDebugPrivilege	3012	Document desription.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4768	3012	Document desription.exe	31
PID 3012 wrote to memory of 4768	3012	Document desription.exe	31
PID 3012 wrote to memory of 4768	3012	Document desription.exe	31

C:\Users\Admin\AppData\Local\Temp\Document desription.exe
"C:\Users\Admin\AppData\Local\Temp\Document desription.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3012 -s 600
  2⤵
  PID:4768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x000007FEF5B83000-0x000007FEF5B84000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x00000000000C0000-0x0000000000218000-memory.dmp

Filesize
1.3MB

Download
memory/3012-2-0x000000001BA20000-0x000000001BB42000-memory.dmp

Filesize
1.1MB

Download
memory/3012-3-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-10-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-12-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-8-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-6-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-4-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-24-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-36-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-50-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-60-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-66-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-64-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-62-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-58-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-56-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-54-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-52-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-48-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-46-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-44-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-42-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-40-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-38-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-34-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-32-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-30-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-28-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-26-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-22-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-20-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-18-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-16-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-14-0x000000001BA20000-0x000000001BB3D000-memory.dmp

Filesize
1.1MB

Download
memory/3012-1325-0x0000000000AD0000-0x0000000000B4E000-memory.dmp

Filesize
504KB

Download
memory/3012-1326-0x0000000002310000-0x000000000238A000-memory.dmp

Filesize
488KB

Download
memory/3012-1327-0x0000000002420000-0x000000000246C000-memory.dmp

Filesize
304KB

Download
memory/3012-1328-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-1329-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-1330-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-1331-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-1332-0x000007FEF5B83000-0x000007FEF5B84000-memory.dmp

Filesize
4KB

Download
memory/3012-1333-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-1334-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-1335-0x0000000002470000-0x00000000024C4000-memory.dmp

Filesize
336KB

Download
memory/3012-1338-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-1339-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download