Analysis

  • max time kernel
    60s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2023 18:37

General

  • Target

    WH-ApkCrypter-V2-master/WH-Apkcrypter-v2.1.exe

  • Size

    47.5MB

  • MD5

    ff56a1336540b6e081c763d4a9ebf032

  • SHA1

    028faefe160dce7c086a1445da52abcfa1d91df3

  • SHA256

    66d56bded084646b509d47f8941ab3a82651c5d58aa9b428b776e1d6efa196b6

  • SHA512

    7d516814df1614b1a8cdea92a61323c19b1fc45af974e79d20be35ae26966b651d793367ee833ae5aaaf6dd4526235a88fe8f5a7822734274674297fd281ec89

  • SSDEEP

    786432:2oVLUw+wlF7NWwCpi9dWsnBD4U5e0i0pktS8SX5owi6VBHWWjLw/pSJBJkMRcd2r:2o5UwVWpi9dW/Sen0+88SJ663W2LPRHF

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WH-ApkCrypter-V2-master\WH-Apkcrypter-v2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\WH-ApkCrypter-V2-master\WH-Apkcrypter-v2.1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1064
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1620
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3324 -s 1112
      2⤵
      • Program crash
      PID:4660
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 496 -p 3324 -ip 3324
    1⤵
      PID:4528

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3324-133-0x0000000004410000-0x0000000004420000-memory.dmp

      Filesize

      64KB

    • memory/3324-134-0x0000000000B10000-0x0000000003A9A000-memory.dmp

      Filesize

      47.5MB

    • memory/3324-135-0x000000001EA40000-0x000000001EAE6000-memory.dmp

      Filesize

      664KB

    • memory/3324-136-0x000000001EFC0000-0x000000001F48E000-memory.dmp

      Filesize

      4.8MB

    • memory/3324-137-0x0000000004410000-0x0000000004420000-memory.dmp

      Filesize

      64KB

    • memory/3324-138-0x000000001F590000-0x000000001F62C000-memory.dmp

      Filesize

      624KB

    • memory/3324-139-0x0000000004540000-0x0000000004548000-memory.dmp

      Filesize

      32KB

    • memory/3324-140-0x000000001F6F0000-0x000000001F73C000-memory.dmp

      Filesize

      304KB

    • memory/3324-141-0x0000000004410000-0x0000000004420000-memory.dmp

      Filesize

      64KB

    • memory/3324-142-0x0000000004410000-0x0000000004420000-memory.dmp

      Filesize

      64KB