8adc1dff793a76a3782ed91fd9ff9f2b511addc67973d93a4ab02a99c32a4496

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2023, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8adc1dff793a76a3782ed91fd9ff9f2b511addc67973d93a4ab02a99c32a4496.exe
Size

1.5MB
MD5

785c62b913918df9de24adb49703e702
SHA1

3f5f0622d6aa80db0996ccc2028c6fa475a857f6
SHA256

8adc1dff793a76a3782ed91fd9ff9f2b511addc67973d93a4ab02a99c32a4496
SHA512

c82385aa92362873019c3d1b3bc602699886d944fd19cd961d47da82f259ccef2ac57675f23f2f26636643d26d973b5cd23501eda05e6aa103bdaa919bcbce81
SSDEEP

12288:3p7/rp2i+rg2b0gE/nRki7S1VOBt8NEo/MHLsnd6MJV9XKAmgOrrJelIEifzGfFi:FrT2Y1njWwKNEo/Z7r9aAq3Je6PCf3U

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3416	1232	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1536	powershell.exe
1536	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	8adc1dff793a76a3782ed91fd9ff9f2b511addc67973d93a4ab02a99c32a4496.exe
Token: SeDebugPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1536	1232	8adc1dff793a76a3782ed91fd9ff9f2b511addc67973d93a4ab02a99c32a4496.exe	83
PID 1232 wrote to memory of 1536	1232	8adc1dff793a76a3782ed91fd9ff9f2b511addc67973d93a4ab02a99c32a4496.exe	83

C:\Users\Admin\AppData\Local\Temp\8adc1dff793a76a3782ed91fd9ff9f2b511addc67973d93a4ab02a99c32a4496.exe
"C:\Users\Admin\AppData\Local\Temp\8adc1dff793a76a3782ed91fd9ff9f2b511addc67973d93a4ab02a99c32a4496.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1232 -s 968
  2⤵
  - Program crash
  PID:3416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 1232 -ip 1232
1⤵
PID:3192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-143-0x00000000006C0000-0x00000000008A8000-memory.dmp

Filesize
1.9MB

Download
memory/1232-144-0x00007FFF7A1A0000-0x00007FFF7A2EE000-memory.dmp

Filesize
1.3MB

Download
memory/1232-136-0x00007FFF7B920000-0x00007FFF7B9DD000-memory.dmp

Filesize
756KB

Download
memory/1232-135-0x00007FFF958F0000-0x00007FFF95902000-memory.dmp

Filesize
72KB

Download
memory/1232-137-0x00007FFF98F50000-0x00007FFF990F1000-memory.dmp

Filesize
1.6MB

Download
memory/1232-139-0x00000000006C0000-0x00000000008A8000-memory.dmp

Filesize
1.9MB

Download
memory/1232-140-0x0000000001130000-0x0000000001171000-memory.dmp

Filesize
260KB

Download
memory/1232-138-0x00007FFF7B9E0000-0x00007FFF7C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/1232-141-0x00007FFF99D60000-0x00007FFF99D8B000-memory.dmp

Filesize
172KB

Download
memory/1232-145-0x00007FFF7B9E0000-0x00007FFF7C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/1232-134-0x00007FFF98EB0000-0x00007FFF98F4E000-memory.dmp

Filesize
632KB

Download
memory/1232-133-0x00007FFF7C4B0000-0x00007FFF7C55A000-memory.dmp

Filesize
680KB

Download
memory/1232-142-0x00000000006C0000-0x00000000008A8000-memory.dmp

Filesize
1.9MB

Download
memory/1232-146-0x00007FFF97CC0000-0x00007FFF97CE7000-memory.dmp

Filesize
156KB

Download
memory/1232-154-0x00007FFF7B9E0000-0x00007FFF7C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/1232-153-0x0000000001130000-0x0000000001171000-memory.dmp

Filesize
260KB

Download
memory/1232-152-0x00000000006C0000-0x00000000008A8000-memory.dmp

Filesize
1.9MB

Download
memory/1232-151-0x00007FFF7CFB0000-0x00007FFF7D11A000-memory.dmp

Filesize
1.4MB

Download
memory/1536-150-0x00007FFF7B9E0000-0x00007FFF7C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/1536-149-0x00007FFF7B9E0000-0x00007FFF7C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/1536-148-0x0000023E1D190000-0x0000023E1D1B2000-memory.dmp

Filesize
136KB

Download