Analysis

  • max time kernel
    93s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 13:21

Errors

Reason
Machine shutdown

General

  • Target

    db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe

  • Size

    43KB

  • MD5

    6913fd0b7cf42c6bc466d52575d1d1f0

  • SHA1

    637b805c072ba3a974e77fc8cf19ec1ad88298ca

  • SHA256

    db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193

  • SHA512

    d28c3ed694aaa5c07577fe78219a42cdfd4110591c7845c2aa003cecc2d556015a26f6e7052c30d99a125e4ade64437ab52783ff5eb8819a3111e700db2d8e5e

  • SSDEEP

    768:u5DZ2Sai733ZL4OsPDsJOrvNQ3wzbYYiUCb6BJZObQC73m9BaNV9kAVy+6f/heT2:ji18OysUQpYiUCb9Z3dggy+9

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
    "C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Windows\SysWOW64\WmInit.exe
      "C:\Windows\system32\WmInit.exe" "C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe"
      2⤵
      • Modifies firewall policy service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2068

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\WmInit.dat

    Filesize

    8B

    MD5

    f1047782af8e9a44a0016b1e74af52bf

    SHA1

    b16822553317851f9faa21232ab7fef77444826d

    SHA256

    b27c0860e731584cd7b8d273510580790573825d4b6ee170d4bc91bbc87df467

    SHA512

    74c63bcd97e0e63da5861c1b866ff6165056f018e726cc9b0bdda7c5be493edae5d33706c8ea3d9ab057e5b352b76cad8d825b64293ec4751b269d245a517140

  • C:\Windows\SysWOW64\WmInit.exe

    Filesize

    33.4MB

    MD5

    0d9a34a0689fe1cc7f4d4dd3493855ad

    SHA1

    2e227168f9682643dbc9ff0f0170d3ff165b901f

    SHA256

    72ffa0846c79bdc528fe070e0738ce5c42807696880aa0762775f9ed345a960a

    SHA512

    2a2acaf4fe867026a4e6bfc8476169331e33bb046857112b8f4bc65bfbbe4a88ec207205d49867d4d226c176548e38243a9ba504c4f142717b3c611e258f2e65

  • C:\Windows\SysWOW64\WmInit.exe

    Filesize

    33.4MB

    MD5

    0d9a34a0689fe1cc7f4d4dd3493855ad

    SHA1

    2e227168f9682643dbc9ff0f0170d3ff165b901f

    SHA256

    72ffa0846c79bdc528fe070e0738ce5c42807696880aa0762775f9ed345a960a

    SHA512

    2a2acaf4fe867026a4e6bfc8476169331e33bb046857112b8f4bc65bfbbe4a88ec207205d49867d4d226c176548e38243a9ba504c4f142717b3c611e258f2e65

  • memory/2068-139-0x0000000000400000-0x000000000050B000-memory.dmp

    Filesize

    1.0MB

  • memory/2068-140-0x0000000000400000-0x000000000050B000-memory.dmp

    Filesize

    1.0MB

  • memory/4300-132-0x0000000000400000-0x000000000050B000-memory.dmp

    Filesize

    1.0MB

  • memory/4300-133-0x0000000000400000-0x000000000050B000-memory.dmp

    Filesize

    1.0MB

  • memory/4300-138-0x0000000000400000-0x000000000050B000-memory.dmp

    Filesize

    1.0MB