44cffe3cf0d9c21377e9aa11635f2fe3d867b6335c4470f0050c469195a782d1

Resubmissions

20/09/2023, 02:12

230920-cnbflsff36 9

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Origin/Origin.exe
Size

2.2MB
MD5

106c6437e141c3ce50ccb6bab796e898
SHA1

07c06b243e2ebbd18e9e978b1a1c466ad373e64d
SHA256

02316eeb6cd43c45a63c9f0fcd43d2cc501a66bb75677ccbd57cb5da9fb78c3b
SHA512

2dff135be0efc19f96990d73755fa8a7c0cd64235489ed1d2743897eb929cd18f3e52535657232f03cc8d955b2fc1b5f0400825e942b019e13e2b2e5016001d9
SSDEEP

49152:MB+Kc09fBm9Xyuc/hAhQDl6fR3V2BTzIJa6:MB1JPm9eAhml6ZEBo

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	3068	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	Origin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2604	3068	Origin.exe	28
PID 3068 wrote to memory of 2604	3068	Origin.exe	28
PID 3068 wrote to memory of 2604	3068	Origin.exe	28
PID 3068 wrote to memory of 2604	3068	Origin.exe	28

C:\Users\Admin\AppData\Local\Temp\Origin\Origin.exe
"C:\Users\Admin\AppData\Local\Temp\Origin\Origin.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1104
  2⤵
  - Program crash
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-0-0x00000000003F0000-0x000000000061E000-memory.dmp

Filesize
2.2MB

Download
memory/3068-1-0x0000000074A50000-0x000000007513E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-2-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/3068-3-0x0000000005F90000-0x00000000063B6000-memory.dmp

Filesize
4.1MB

Download
memory/3068-4-0x0000000074A50000-0x000000007513E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-5-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download