6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342

Analysis

max time kernel
123s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342.exe
Size

708KB
MD5

608af742bf4d08081df5e349f4ed0450
SHA1

c1098d1497665ebe16db235ab99610eb615aef3d
SHA256

6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342
SHA512

df7e252c53c731b7f6620011db44f288843c93e885c4733225fc75e8572acd70e738061f08eeadaa2aa85de675da33579b1eb30766110956c81a723eea637c48
SSDEEP

12288:lCiKrE/+dx+qNEf4Ms7qOvkczKLFF3Z4mxxQ6Ii9jA7nh0qsvFtOo:EiYO+dOf4EOccgFQmXLbxA7niFtB

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a000000022f67-134.dat	aspack_v212_v242
behavioral2/files/0x000a000000022f67-135.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2744	NoHacker.cn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\NoHacker.cn.exe	6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342.exe
File opened for modification	C:\Windows\NoHacker.cn.exe	6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1148	4940	WerFault.exe	80
4696	4940	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342.exe
Token: SeDebugPrivilege	2744	NoHacker.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	NoHacker.cn.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2256	2744	NoHacker.cn.exe	82
PID 2744 wrote to memory of 2256	2744	NoHacker.cn.exe	82

C:\Users\Admin\AppData\Local\Temp\6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342.exe
"C:\Users\Admin\AppData\Local\Temp\6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 708
  2⤵
  - Program crash
  PID:1148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 716
  2⤵
  - Program crash
  PID:4696

C:\Windows\NoHacker.cn.exe
C:\Windows\NoHacker.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4940 -ip 4940
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4940 -ip 4940
1⤵
PID:4412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\NoHacker.cn.exe

Filesize
708KB

MD5
608af742bf4d08081df5e349f4ed0450

SHA1
c1098d1497665ebe16db235ab99610eb615aef3d

SHA256
6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342

SHA512
df7e252c53c731b7f6620011db44f288843c93e885c4733225fc75e8572acd70e738061f08eeadaa2aa85de675da33579b1eb30766110956c81a723eea637c48

Download Submit
C:\Windows\NoHacker.cn.exe

Filesize
708KB

MD5
608af742bf4d08081df5e349f4ed0450

SHA1
c1098d1497665ebe16db235ab99610eb615aef3d

SHA256
6b04791270b5db35a1380b04623b0e3e0bef3a59fb7da3204766df57c9ea1342

SHA512
df7e252c53c731b7f6620011db44f288843c93e885c4733225fc75e8572acd70e738061f08eeadaa2aa85de675da33579b1eb30766110956c81a723eea637c48

Download Submit
memory/2744-136-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2744-137-0x0000000000E70000-0x0000000000EC4000-memory.dmp

Filesize
336KB

Download
memory/2744-139-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4940-132-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4940-133-0x00000000022D0000-0x0000000002324000-memory.dmp

Filesize
336KB

Download
memory/4940-138-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download