Analysis
-
max time kernel
111s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
-
submitted
28/08/2023, 06:21
General
-
Target
fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7.exe
-
Size
8.7MB
-
MD5
e8e8cf7821915da7b1f04ff6930b7e07
-
SHA1
6fd4bb8a777cb4c732d319fc7b485e5a01037030
-
SHA256
fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
-
SHA512
54258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
SSDEEP
196608:D6nmOG+MxcBD0kvbbVViXEoyxf+lHb6e6SQDi46eE7wUAwGDx0cJDR:D6nmOG+MSg6b6XEoN6SQDiRbw2KDR
Score
7/10
Malware Config
Signatures
-
Themida packer 12 IoCs
Detects Themida, an advanced Windows software protection system.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7.exe"C:\Users\Admin\AppData\Local\Temp\fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 7642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3784 -ip 37841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.2MB
-
Filesize
8KB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB