08d215fd35494280e6397e8bc527bd6de64eb78a73acd3bd07a01da376ed4cb7 | Triage

Resubmissions

07-02-2022 00:34

220207-aw81qsdce2 10

Analysis

max time kernel
120s
max time network
153s
platform
windows7_x64
resource
win7-en-20211208
submitted
07-02-2022 00:34

Sharing

Report Analysis Logs

General

Target

HANS.exe
Size

481KB
MD5

1f0c86722e882c3a2e1b2aced5b338d6
SHA1

2a1c02f4dcd53906dda8703219b7505fad15df03
SHA256

1c83962ea10ce2aac61fe881ae8d79514148be5fc90c121a6fa285d6f640ee0c
SHA512

e38b5c86610a07e85247e9eb571aeb750e8f867d637ff0e40c1067720ac51a50c9dfe7942a0854a2bb2318ce747f449549818c23a9859b03a64a4376a6bc5439

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
784	1760	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe
784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	HANS.exe
Token: SeDebugPrivilege	784	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 784	1760	HANS.exe	29
PID 1760 wrote to memory of 784	1760	HANS.exe	29
PID 1760 wrote to memory of 784	1760	HANS.exe	29
PID 1760 wrote to memory of 784	1760	HANS.exe	29

C:\Users\Admin\AppData\Local\Temp\HANS.exe
"C:\Users\Admin\AppData\Local\Temp\HANS.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1144
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-59-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1760-55-0x0000000001240000-0x00000000012BE000-memory.dmp

Filesize
504KB

Download
memory/1760-56-0x0000000074B21000-0x0000000074B23000-memory.dmp

Filesize
8KB

Download
memory/1760-57-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download