Overview
overview
10Static
static
10PKSJ Malwa...87.exe
windows7-x64
1PKSJ Malwa...87.exe
windows10-2004-x64
3PKSJ Malwa...4d.exe
windows7-x64
8PKSJ Malwa...4d.exe
windows10-2004-x64
8PKSJ Malwa...c9.xls
windows7-x64
10PKSJ Malwa...c9.xls
windows10-2004-x64
10PKSJ Malwa...f9.doc
windows7-x64
10PKSJ Malwa...f9.doc
windows10-2004-x64
10PKSJ Malwa...30.pdf
windows7-x64
1PKSJ Malwa...30.pdf
windows10-2004-x64
1PKSJ Malwa...8d.exe
windows7-x64
1PKSJ Malwa...8d.exe
windows10-2004-x64
1PKSJ Malwa...fa.exe
windows7-x64
1PKSJ Malwa...fa.exe
windows10-2004-x64
3PKSJ Malwa...c8.doc
windows7-x64
10PKSJ Malwa...c8.doc
windows10-2004-x64
10PKSJ Malwa...03.doc
windows7-x64
1PKSJ Malwa...03.doc
windows10-2004-x64
1PKSJ Malwa...40.pdf
windows7-x64
1PKSJ Malwa...40.pdf
windows10-2004-x64
1PKSJ Malwa...4e.doc
windows7-x64
1PKSJ Malwa...4e.doc
windows10-2004-x64
1PKSJ Malwa...cd.pdf
windows7-x64
1PKSJ Malwa...cd.pdf
windows10-2004-x64
1PKSJ Malwa...7b.exe
windows7-x64
10PKSJ Malwa...7b.exe
windows10-2004-x64
10PKSJ Malwa...82.exe
windows7-x64
1PKSJ Malwa...82.exe
windows10-2004-x64
3PKSJ Malwa...6f.doc
windows7-x64
10PKSJ Malwa...6f.doc
windows10-2004-x64
10PKSJ Malwa...d2.doc
windows7-x64
1PKSJ Malwa...d2.doc
windows10-2004-x64
1Analysis
-
max time kernel
31s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2022 06:08
Behavioral task
behavioral1
Sample
PKSJ Malware/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PKSJ Malware/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
PKSJ Malware/1/VirusShare_0aee78510c46e3a200b6bc21ac1c954d.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
PKSJ Malware/1/VirusShare_0aee78510c46e3a200b6bc21ac1c954d.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
PKSJ Malware/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
PKSJ Malware/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
PKSJ Malware/1/VirusShare_1ba8249d8503c0cf7bc125588c43bef9.doc
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
PKSJ Malware/1/VirusShare_1ba8249d8503c0cf7bc125588c43bef9.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
PKSJ Malware/1/VirusShare_3cd9a967b67fe69351e390195ca7a430.pdf
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
PKSJ Malware/1/VirusShare_3cd9a967b67fe69351e390195ca7a430.pdf
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
PKSJ Malware/2/VirusShare_01b55404de50bd1a56343b2f316ff88d.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
PKSJ Malware/2/VirusShare_01b55404de50bd1a56343b2f316ff88d.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
PKSJ Malware/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
PKSJ Malware/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
PKSJ Malware/2/VirusShare_2fe5b00079aec2d8369a798230313ec8.doc
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
PKSJ Malware/2/VirusShare_2fe5b00079aec2d8369a798230313ec8.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
PKSJ Malware/2/VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.doc
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
PKSJ Malware/2/VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
PKSJ Malware/2/VirusShare_480ef02bb062a57724e1b3e14532a140.pdf
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
PKSJ Malware/2/VirusShare_480ef02bb062a57724e1b3e14532a140.pdf
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
PKSJ Malware/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e.doc
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
PKSJ Malware/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
PKSJ Malware/3/VirusShare_4675e87be15585e66b0c88b833dd9ecd.pdf
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
PKSJ Malware/3/VirusShare_4675e87be15585e66b0c88b833dd9ecd.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
PKSJ Malware/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
PKSJ Malware/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
PKSJ Malware/3/VirusShare_5c8b670c503455baafbff400a446cf82.exe
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
PKSJ Malware/3/VirusShare_5c8b670c503455baafbff400a446cf82.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
PKSJ Malware/3/VirusShare_6ad036ba93c94d6976e2d93c7a3aec6f.doc
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
PKSJ Malware/3/VirusShare_6ad036ba93c94d6976e2d93c7a3aec6f.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
PKSJ Malware/4/VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2.doc
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
PKSJ Malware/4/VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2.doc
Resource
win10v2004-20220812-en
General
-
Target
PKSJ Malware/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe
-
Size
2.9MB
-
MD5
1ad9a67240d5775395c45b64dd6529fa
-
SHA1
c653d2c475f639ad68c210e0f9d829344c5663c7
-
SHA256
3751298058a2a5d0912caa35bfdbafa48ae788647b536e69ad383c7c1990dd9d
-
SHA512
721b1c577db1cfe5465eaceadf2a7cc9d3f68d341f98d7dcc4bde2ff606f359b6bc917e993f5f05e9897b7957ca2617fa03937c2aea6a8462b86f2e750397c23
-
SSDEEP
49152:4obi85jFGg0IZHVA/pfa8u0Ikjhd6kss8CYxB52ibDIJZKpYg0Kg9e+KgFTRFO:Vzh6/I8u0IktgkOvxBUibs2Z0ggFdE
Malware Config
Signatures
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1176 536 WerFault.exe VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe 4988 536 WerFault.exe VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\2\VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe"C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\2\VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 3882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 4002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 536 -ip 5361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-132-0x00000000022A0000-0x000000000250A000-memory.dmpFilesize
2.4MB
-
memory/536-134-0x0000000002780000-0x00000000029E9000-memory.dmpFilesize
2.4MB
-
memory/536-133-0x0000000002510000-0x0000000002777000-memory.dmpFilesize
2.4MB
-
memory/536-140-0x0000000002780000-0x00000000029E9000-memory.dmpFilesize
2.4MB
-
memory/536-147-0x0000000002780000-0x00000000029E9000-memory.dmpFilesize
2.4MB
-
memory/536-149-0x00000000029F0000-0x0000000002C47000-memory.dmpFilesize
2.3MB
-
memory/536-148-0x0000000002781000-0x00000000029E3000-memory.dmpFilesize
2.4MB
-
memory/536-150-0x0000000002510000-0x0000000002777000-memory.dmpFilesize
2.4MB