Analysis

  • max time kernel
    91s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 19:38

General

  • Target

    c38253f8d773c3b3d9a0ddc6a46464014d2568221cbe8a9fccadeb8a2de303e5.exe

  • Size

    48KB

  • MD5

    a559acfaa60a579b39ae7fd276ae3d9e

  • SHA1

    e9b679c67fd1b280f8c3e08d51c2f326160c8c5d

  • SHA256

    c38253f8d773c3b3d9a0ddc6a46464014d2568221cbe8a9fccadeb8a2de303e5

  • SHA512

    9ccf11d6a613bc918b2fca794699144049edbf5a8f691268a6861475df51682e6d8956a6e843e8a2a98bfc8f80383805231c6f3b13b183f9245f86795cd0ac03

  • SSDEEP

    768:bQ5hdL6QjWUGmrQZi+LtmtnB7CwgbLaTTIIMdzstb:q2UGdiOt2nBGl+TKdzstb

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c38253f8d773c3b3d9a0ddc6a46464014d2568221cbe8a9fccadeb8a2de303e5.exe
    "C:\Users\Admin\AppData\Local\Temp\c38253f8d773c3b3d9a0ddc6a46464014d2568221cbe8a9fccadeb8a2de303e5.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:760
  • C:\Windows\SysWOW64\mexjkm.exe
    C:\Windows\SysWOW64\mexjkm.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:4012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 392
      2⤵
      • Program crash
      PID:224
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 760 -ip 760
    1⤵
      PID:4556
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4012 -ip 4012
      1⤵
        PID:3480

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\mexjkm.exe
        Filesize

        48KB

        MD5

        a559acfaa60a579b39ae7fd276ae3d9e

        SHA1

        e9b679c67fd1b280f8c3e08d51c2f326160c8c5d

        SHA256

        c38253f8d773c3b3d9a0ddc6a46464014d2568221cbe8a9fccadeb8a2de303e5

        SHA512

        9ccf11d6a613bc918b2fca794699144049edbf5a8f691268a6861475df51682e6d8956a6e843e8a2a98bfc8f80383805231c6f3b13b183f9245f86795cd0ac03

      • C:\Windows\SysWOW64\mexjkm.exe
        Filesize

        48KB

        MD5

        a559acfaa60a579b39ae7fd276ae3d9e

        SHA1

        e9b679c67fd1b280f8c3e08d51c2f326160c8c5d

        SHA256

        c38253f8d773c3b3d9a0ddc6a46464014d2568221cbe8a9fccadeb8a2de303e5

        SHA512

        9ccf11d6a613bc918b2fca794699144049edbf5a8f691268a6861475df51682e6d8956a6e843e8a2a98bfc8f80383805231c6f3b13b183f9245f86795cd0ac03