3759744039346620e9613f40f90e8f318e5f54ad49c070e2bd23b667f7e65bf6

Analysis

max time kernel
99s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2023 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mercurial.exe
Size

3.2MB
MD5

a9477b3e21018b96fc5d2264d4016e65
SHA1

493fa8da8bf89ea773aeb282215f78219a5401b7
SHA256

890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
SHA512

66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c
SSDEEP

98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1912 524 WerFault.exe Mercurial.exe
4696 524 WerFault.exe Mercurial.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Mercurial.exe

pid process

524 Mercurial.exe
524 Mercurial.exe
524 Mercurial.exe
524 Mercurial.exe
524 Mercurial.exe
524 Mercurial.exe
524 Mercurial.exe
524 Mercurial.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Mercurial.exe

description pid process

Token: SeDebugPrivilege 524 Mercurial.exe

pid	pid_target	process	target process
1912	524	WerFault.exe	Mercurial.exe
4696	524	WerFault.exe	Mercurial.exe

pid	process
524	Mercurial.exe
524	Mercurial.exe
524	Mercurial.exe
524	Mercurial.exe
524	Mercurial.exe
524	Mercurial.exe
524	Mercurial.exe
524	Mercurial.exe

description	pid	process
Token: SeDebugPrivilege	524	Mercurial.exe

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 1636
2⤵
- Program crash
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 1672
2⤵
- Program crash
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 524 -ip 524
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 524 -ip 524
1⤵
PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-133-0x00000000007C0000-0x0000000000AFA000-memory.dmp

Filesize
3.2MB

Download
memory/524-134-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/524-135-0x00000000054B0000-0x0000000005542000-memory.dmp

Filesize
584KB

Download
memory/524-136-0x0000000005550000-0x000000000555A000-memory.dmp

Filesize
40KB

Download
memory/524-137-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-138-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-139-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-140-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-141-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-142-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-143-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-144-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-145-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-146-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-147-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-148-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-149-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-150-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/524-151-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-152-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-153-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-154-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-155-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-156-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-157-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-158-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download
memory/524-159-0x000000000BFB0000-0x000000000C0B0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads