1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db

Analysis

max time kernel
73s
max time network
80s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04/07/2023, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe
Size

6KB
MD5

bbf3c156c81b7872f4033ec0060470fe
SHA1

5013a1253adc952796f7d334175554bd731f5d9d
SHA256

1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db
SHA512

7d7ac7c0d515a4e601abda7a77db336f8bed0a0cf540d0a7c5fb685cfc2a32078b637e03581b9b585513e24d3ab138418495ae4079c9b8d1e7240134d1543da4
SSDEEP

48:62IQcnLTH2pv6nfZZPg3A0TNMvU+MxIXuXjfPJdi8PFPviujFroGSTxbiKUtJ+Fr:ID24vZTQzfPlPxiu5S9OKt+4NmPzNt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	3004	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1536	3004	challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe	29
PID 3004 wrote to memory of 1536	3004	challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe	29
PID 3004 wrote to memory of 1536	3004	challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe	29
PID 3004 wrote to memory of 1536	3004	challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe	29

C:\Users\Admin\AppData\Local\Temp\challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe
"C:\Users\Admin\AppData\Local\Temp\challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1100
  2⤵
  - Program crash
  PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nvda\userConfig\addons\remote\locale\gl\manifest.ini

Filesize
112B

MD5
af4796c9a0bada2e34c2846af99302aa

SHA1
1eeecee3d398509ae68d3d10f4acf025cc8d4961

SHA256
ac5bcd846a1f5b0fbbd3c928eee88695965f629675b188b79c084bc2047990af

SHA512
2c672d2cec0e3a2a8de738a51bf7225fdc957df5bad9007c7b25d4c1e0f977cd88a600cb040fbebd96143edde28c0f6207223f524bb008016a94c7d03506f628

Download Submit
C:\Users\Admin\AppData\Local\Temp\nvda\userConfig\addons\wintenApps\locale\mn\manifest.ini

Filesize
127B

MD5
faa1f1b57ebd8a5cd52a14a2f86e413a

SHA1
5b616617eb913c814f66d183e2d44ae0b60db021

SHA256
d03c2da424736183b58b1e880d84153da8a2db61c3d4f44bfc5d5759e84478e6

SHA512
0772de6b4ab9548f19567299041b2f6b6a48788da6cd0201a25ff9ee45244a968cbdb37dec0224baab1e5e74cc3aa11e9a211380a574e3344ae063cf0f503792

Download Submit
memory/3004-54-0x0000000000980000-0x0000000000988000-memory.dmp

Filesize
32KB

Download
memory/3004-55-0x00000000044C0000-0x0000000004500000-memory.dmp

Filesize
256KB

Download
memory/3004-1192-0x00000000044C0000-0x0000000004500000-memory.dmp

Filesize
256KB

Download