Overview

overview

6

Static

static

84b618cf8f...a3.exe

windows7-x64

6

84b618cf8f...a3.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    91s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 18:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

  • Size

    56KB

  • MD5

    42fd58c2705d9824457d96db5460aff0

  • SHA1

    981fefd7b4add0d5c4735bd839308a20ed9288aa

  • SHA256

    84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3

  • SHA512

    819951137f1652b1f27d60d516cfceec4847d4e7cdae7277bc4792bf774d8a3389a848acd1db5725f02be58b779dde074d33621affc3b9d2e02b1d2372c7bca8

  • SSDEEP

    768:INdsjQ61yYA9X0bKmIkwf4/tCPwUjRIjaV376:IwPY9XAKeURj6jaV37

Score
6/10

Malware Config

Signatures

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
    "C:\Users\Admin\AppData\Local\Temp\84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4996
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 732
      2⤵
      • Program crash
      PID:1416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4996 -ip 4996
    1⤵
      PID:1152

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads