Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
12-10-2022 17:58
General
-
Target
ade18f4a294b6c03ef1b9d695e2edbd4b07084a8ddc2889b963f929be44f8d11.exe
-
Size
392KB
-
MD5
6627fc1d33e5b0445cc390e53a3c3b88
-
SHA1
978497fdc330b925aade2690e5be9c09899b6bb4
-
SHA256
ade18f4a294b6c03ef1b9d695e2edbd4b07084a8ddc2889b963f929be44f8d11
-
SHA512
f4f5d57b613434740b2bfd52bd00ad9923d6cd89826588370d758442bbec08abd85faaba301b30433148ad7f0d6a70f09a2dd6f987b8b44bb955574e03b1ceda
-
SSDEEP
12288:xcbvS+ScjNJcMjrkzg2MDk1isKMJim4Pm1hFgWohLiUsoXYW30FsE0fG:r/1wJkFsE0e
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in Windows directory 4 IoCs
-
Program crash 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ade18f4a294b6c03ef1b9d695e2edbd4b07084a8ddc2889b963f929be44f8d11.exe"C:\Users\Admin\AppData\Local\Temp\ade18f4a294b6c03ef1b9d695e2edbd4b07084a8ddc2889b963f929be44f8d11.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 14482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1732 -ip 17321⤵
-
C:\Users\Admin\AppData\Local\Temp\ade18f4a294b6c03ef1b9d695e2edbd4b07084a8ddc2889b963f929be44f8d11.exeC:\Users\Admin\AppData\Local\Temp\ade18f4a294b6c03ef1b9d695e2edbd4b07084a8ddc2889b963f929be44f8d11.exe1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 14602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4404 -ip 44041⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
426B
MD524870845dd706a864aa84c76593518f5
SHA1f1c95f889154a984babd3af97718dd018d26dcb4
SHA256073d78b33d3f788a668e7869de839839283d984107b5fb56320659e3f927e2ad
SHA512480835c34c62587c2d068e74959fc84ffc6a5720b5941822927945cabee80435b420f370ffc96a8baf848b18a8449c4db206c0d83fad5e56a8e95c089a461f23
-
Filesize
396KB
-
Filesize
236KB
-
Filesize
396KB
-
Filesize
236KB
-
Filesize
396KB
-
Filesize
236KB
-
Filesize
236KB