cc8375aa58734b36cd83948fc365e0274d3653643280f48e2720617b64b1ca57 | Triage

Analysis

max time kernel
207s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 08:18

Sharing

Report Analysis Logs

General

Target

111.exe
Size

2.8MB
MD5

4bd543b8c82295231553065666df246c
SHA1

4c0911e7d0a9c1f4eb4642b554d2caf7a2f1eff4
SHA256

cc8375aa58734b36cd83948fc365e0274d3653643280f48e2720617b64b1ca57
SHA512

1bd152b179903722ba5930db981456a5b8f5d6a3fc4de5901264c8883230af6433165b6767cfa0a7a40f3c0a25346d6eb01592b788cdb8d1315a748c9ebffeae
SSDEEP

49152:OwKvp0ee4VckiKXZP9gBs3oLWkOxxChx:Lop0ee4Vcki+F9hGko

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4248	4892	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe
4892	111.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	111.exe

C:\Users\Admin\AppData\Local\Temp\111.exe
"C:\Users\Admin\AppData\Local\Temp\111.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 836
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4892 -ip 4892
1⤵
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4892-132-0x0000000000A10000-0x0000000000CDC000-memory.dmp

Filesize
2.8MB

Download