a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c | Triage

Analysis

max time kernel
226s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:34

Sharing

Report Analysis Logs

General

Target

typhoon.exe
Size

2.3MB
MD5

d1d84c844681fe3c672a713c1a3bf52c
SHA1

099ec412993603c50ec87fd27c2315bd87b6fe7e
SHA256

a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c
SHA512

3ee33d27c03f4b1e9977ea8b8905ec070cfc74adf4327dbb81923c2fa2df412d5f9d08b1d7e49c54ccf6333728a8e3c2ae278b79a214bb662854f8019dee25d0
SSDEEP

49152:8UbowEOvygS7/1sHOqJ02nTPFdRPqxMai2TBmCs2Odw+W7SC:8Ucwti78OqJ7TPB2Tc2Ou

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ipinfo.io
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1384 612 WerFault.exe typhoon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

typhoon.exe

description pid process

Token: SeDebugPrivilege 612 typhoon.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

typhoon.exe

description	pid	process	target process
PID 612 wrote to memory of 1384	612	typhoon.exe	WerFault.exe
PID 612 wrote to memory of 1384	612	typhoon.exe	WerFault.exe
PID 612 wrote to memory of 1384	612	typhoon.exe	WerFault.exe
PID 612 wrote to memory of 1384	612	typhoon.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\typhoon.exe
"C:\Users\Admin\AppData\Local\Temp\typhoon.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 1508
2⤵
- Program crash
PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-54-0x0000000000820000-0x0000000000A72000-memory.dmp

Filesize
2.3MB

Download
memory/612-55-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/1384-56-0x0000000000000000-mapping.dmp

Download