Analysis
-
max time kernel
150s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06-12-2022 23:10
General
-
Target
c101759aa8da97c6dfc5374ff246b6def367226185ea23e0fa42c546e2943470.exe
-
Size
3.4MB
-
MD5
f51c649edeedcb1e8ffc9a79eff86816
-
SHA1
ae8f6aab757e1539b427a7151f406da178e7bc02
-
SHA256
c101759aa8da97c6dfc5374ff246b6def367226185ea23e0fa42c546e2943470
-
SHA512
8ada88562d95a25eff6371b3ea269996d1e1a7203f641beb1c851cb5f1b6cc52a16f941cfbd8c8d5c443a8558c43ec6e5746dfe160cd906dc12a1ddf1c254124
-
SSDEEP
3072:3g64yo/pjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjq:QfzE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Program crash 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c101759aa8da97c6dfc5374ff246b6def367226185ea23e0fa42c546e2943470.exe"C:\Users\Admin\AppData\Local\Temp\c101759aa8da97c6dfc5374ff246b6def367226185ea23e0fa42c546e2943470.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft\ActiveLphe.ini"C:\Windows\Microsoft\ActiveLphe.ini"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 7123⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 7123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3940 -ip 39401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5d4522b0cfda2ba9ef85770a7d029860b
SHA1be63514ab7c172e4a52c10c1cec1ae2f4138a5ca
SHA2567794040a6a5e979955e34afe9b3496e9793eb39a451b63937d3341450138a96f
SHA512a10399a99fa6277ce9f30b52a4cd88655d117fb1408b670dfbf30ed9f01e44b85820d807ba20986ec85efe9c21cdbaa0c31906af16e0e7d7a2a568c365ad4ad3
-
Filesize
13.3MB
MD50f215dbd303a2fb3a9db2f9a5ee398ba
SHA1aba5f5b6a8d95dc025fd3206591a30acf0175662
SHA25687314c75b0f53a4e8d67fa8a9b1872587744dc06e75dfe8ebe909aa3ad2fcb8e
SHA512bef37d776b1e06c47089f6b7284f4e22aced5582690fccd8418645c0f5f52d5d029fd7990b0ef9e6895da949d77c0af4ce78f7de35c9419929289d61eb85654a
-
Filesize
13.3MB
MD50f215dbd303a2fb3a9db2f9a5ee398ba
SHA1aba5f5b6a8d95dc025fd3206591a30acf0175662
SHA25687314c75b0f53a4e8d67fa8a9b1872587744dc06e75dfe8ebe909aa3ad2fcb8e
SHA512bef37d776b1e06c47089f6b7284f4e22aced5582690fccd8418645c0f5f52d5d029fd7990b0ef9e6895da949d77c0af4ce78f7de35c9419929289d61eb85654a
-
-