Overview
overview
10Static
static
10001.exe
windows7_x64
10001.exe
windows10-2004_x64
101488.exe
windows7_x64
101488.exe
windows10-2004_x64
11_cr.exe
windows7_x64
51_cr.exe
windows10-2004_x64
41cr.exe
windows7_x64
101cr.exe
windows10-2004_x64
41fc2d.exe
windows7_x64
101fc2d.exe
windows10-2004_x64
106e7_2021-0...04.exe
windows7_x64
106e7_2021-0...04.exe
windows10-2004_x64
10Abjects.exe
windows7_x64
1Abjects.exe
windows10-2004_x64
4BattleText.exe
windows7_x64
10BattleText.exe
windows10-2004_x64
1HANS.exe
windows7_x64
3HANS.exe
windows10-2004_x64
1Hulu.exe
windows7_x64
8Hulu.exe
windows10-2004_x64
8IntelFIVE.exe
windows7_x64
3IntelFIVE.exe
windows10-2004_x64
7IntelFOUR.exe
windows7_x64
3IntelFOUR.exe
windows10-2004_x64
7IntelONE.exe
windows7_x64
3IntelONE.exe
windows10-2004_x64
7IntelTHREE.exe
windows7_x64
3IntelTHREE.exe
windows10-2004_x64
7IntelTWO.exe
windows7_x64
3IntelTWO.exe
windows10-2004_x64
7Lucky_Fixed.exe
windows7_x64
3Lucky_Fixed.exe
windows10-2004_x64
10Resubmissions
07-02-2022 00:34
220207-aw81qsdce2 10Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-02-2022 00:34
Behavioral task
behavioral1
Sample
001.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
001.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
1488.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
1488.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
1_cr.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
1_cr.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
1cr.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
1cr.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral9
Sample
1fc2d.exe
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
1fc2d.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral11
Sample
6e7_2021-01-19_18-04.exe
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
6e7_2021-01-19_18-04.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral13
Sample
Abjects.exe
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
Abjects.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
BattleText.exe
Resource
win7-en-20211208
Behavioral task
behavioral16
Sample
BattleText.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
HANS.exe
Resource
win7-en-20211208
Behavioral task
behavioral18
Sample
HANS.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral19
Sample
Hulu.exe
Resource
win7-en-20211208
Behavioral task
behavioral20
Sample
Hulu.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral21
Sample
IntelFIVE.exe
Resource
win7-en-20211208
Behavioral task
behavioral22
Sample
IntelFIVE.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral23
Sample
IntelFOUR.exe
Resource
win7-en-20211208
Behavioral task
behavioral24
Sample
IntelFOUR.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral25
Sample
IntelONE.exe
Resource
win7-en-20211208
Behavioral task
behavioral26
Sample
IntelONE.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral27
Sample
IntelTHREE.exe
Resource
win7-en-20211208
Behavioral task
behavioral28
Sample
IntelTHREE.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral29
Sample
IntelTWO.exe
Resource
win7-en-20211208
Behavioral task
behavioral30
Sample
IntelTWO.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral31
Sample
Lucky_Fixed.exe
Resource
win7-en-20211208
Behavioral task
behavioral32
Sample
Lucky_Fixed.exe
Resource
win10v2004-en-20220112
General
-
Target
Lucky_Fixed.exe
-
Size
267KB
-
MD5
c481259ad199b773339f168902cc7437
-
SHA1
4c9a81f2a9167f953109eddbd141ea8d078d13e9
-
SHA256
1da5a6aac7197d1fcadef018775831885b715d5c37a3115777dc5c717ce6e0da
-
SHA512
5bc8965e9aa550f3e37b312f3d4a6854b0002f42b5a111087a754e3ed7cdcf957b40f6bebc389b405317b46eeaed88132545732daac74723945591ae38cdcabf
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 800 1128 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 800 WerFault.exe 800 WerFault.exe 800 WerFault.exe 800 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 800 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1128 Lucky_Fixed.exe Token: SeDebugPrivilege 800 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1128 wrote to memory of 800 1128 Lucky_Fixed.exe 27 PID 1128 wrote to memory of 800 1128 Lucky_Fixed.exe 27 PID 1128 wrote to memory of 800 1128 Lucky_Fixed.exe 27 PID 1128 wrote to memory of 800 1128 Lucky_Fixed.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lucky_Fixed.exe"C:\Users\Admin\AppData\Local\Temp\Lucky_Fixed.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 11402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:800
-