2b8235f92ed8e96ccd83e8a47428642f4d0599df496dc7c2d75772c3cc9d54cc | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-03-2023 21:54

Sharing

Report Analysis Logs

General

Target

Hola-Setup-C-Cadv1.exe
Size

1.4MB
MD5

0ae910eee527d508745f79d10762fdfb
SHA1

e40557b1cbf21942c45c0462e1b24a1a83ef9e99
SHA256

2b8235f92ed8e96ccd83e8a47428642f4d0599df496dc7c2d75772c3cc9d54cc
SHA512

7ca24844010d5be334d78dbb808b60785a1b4e507425e94c840d4bdd30f2aea8a4821e309c9ed673291d952cfae29868e73b9adc5ad436a39691720fc8b71afa
SSDEEP

24576:2nlwinUv+L8m657w6ZBLmkitKqBCjC0PDgM5A4woGHp:2nlyuVV1BCjBkJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

520 1536 WerFault.exe Hola-Setup-C-Cadv1.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Hola-Setup-C-Cadv1.exe

pid process

1536 Hola-Setup-C-Cadv1.exe
1536 Hola-Setup-C-Cadv1.exe
1536 Hola-Setup-C-Cadv1.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Hola-Setup-C-Cadv1.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1536	Hola-Setup-C-Cadv1.exe
Token: 33	1844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1844	AUDIODG.EXE
Token: 33	1844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1844	AUDIODG.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Hola-Setup-C-Cadv1.exe

description	pid	process	target process
PID 1536 wrote to memory of 520	1536	Hola-Setup-C-Cadv1.exe	WerFault.exe
PID 1536 wrote to memory of 520	1536	Hola-Setup-C-Cadv1.exe	WerFault.exe
PID 1536 wrote to memory of 520	1536	Hola-Setup-C-Cadv1.exe	WerFault.exe
PID 1536 wrote to memory of 520	1536	Hola-Setup-C-Cadv1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-Cadv1.exe
"C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-Cadv1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1240
2⤵
- Program crash
PID:520

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1260

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:864

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x558
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-54-0x0000000000180000-0x00000000002E8000-memory.dmp

Filesize
1.4MB

Download
memory/1536-55-0x0000000005120000-0x0000000005160000-memory.dmp

Filesize
256KB

Download
memory/1536-56-0x0000000005120000-0x0000000005160000-memory.dmp

Filesize
256KB

Download