753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

Analysis

max time kernel
156s
max time network
47s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
Size

5.1MB
MD5

9e4afe00eeccfecd3b0af3b53b3eff9d
SHA1

a1189ac5ddc87a0e6b806ae757b419b0773b9f1f
SHA256

753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2
SHA512

bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Human AI.exe

pid process

1544 Human AI.exe

pid	process
1544	Human AI.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1544-61-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1544-49214-0x0000000000400000-0x0000000000921000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Human AI.lnk	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe

Loads dropped DLL 10 IoCs

Processes:

753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exeWerFault.exe

pid	process
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 1544 WerFault.exe Human AI.exe

pid	pid_target	process	target process
1476	1544	WerFault.exe	Human AI.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe

pid	process
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe

description	pid	process	target process
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe
PID 1772 wrote to memory of 1544	1772	753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe	Human AI.exe

C:\Users\Admin\AppData\Local\Temp\753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe
"C:\Users\Admin\AppData\Local\Temp\753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Roaming\Adobe\Human AI.exe
"C:\Users\Admin\AppData\Local\Temp\753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2.exe"
2⤵
- Executes dropped EXE
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 88
3⤵
- Loads dropped DLL
- Program crash
PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Human AI.exe

Filesize
5.1MB

MD5
9e4afe00eeccfecd3b0af3b53b3eff9d

SHA1
a1189ac5ddc87a0e6b806ae757b419b0773b9f1f

SHA256
753842efd2e08e936743e8e0a2042834d53d44b7f35158be4565374c051542b2

SHA512
bfbd4d4e5f01acc0a617c69f884e8d748453a45463fbcdf96634cdaff86b41e670c4d1558ce05a62c09e75b02b77632b9db3ba6fc2210100aa88f1e8818cd042

Download Submit
memory/1476-49215-0x0000000000000000-mapping.dmp

Download
memory/1544-49214-0x0000000000400000-0x0000000000921000-memory.dmp

Filesize
5.1MB

Download
memory/1544-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1544-59-0x0000000000000000-mapping.dmp

Download
memory/1772-994-0x0000000000220000-0x000000000029B000-memory.dmp

Filesize
492KB

Download
memory/1772-54-0x0000000000220000-0x000000000029B000-memory.dmp

Filesize
492KB

Download
memory/1772-55-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download