8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exe
Size

14.8MB
MD5

e6c5702ae276836323160dea8c2d1478
SHA1

7c493d2c4147bdf348d5d7d8d385a3d833ae2f13
SHA256

8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b
SHA512

b83ba6744e4e08bf82c77fef2bc85acebf5d86b073b9d0c133a59c2a0bcd8c3dc392c807b416004cb86212023113b4ca715a10e0a5dbfd4222bbf197470a457a
SSDEEP

393216:3VhgLN/qpGQLRetJxStNGUVzLCxqFltC9ysX5qL18vkrrN9YVseQ1:3VhgR/tnnUUxItC9pXgScrJ9YVW1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	3120	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3120	8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3120	8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exe
3120	8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exe
3120	8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exe
3120	8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exe

C:\Users\Admin\AppData\Local\Temp\8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exe
"C:\Users\Admin\AppData\Local\Temp\8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 2964
  2⤵
  - Program crash
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3120 -ip 3120
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6c3fb7d2eb7b41d90b1c0fbccd2ebcf1.ini

Filesize
1KB

MD5
14f2d2cdc854ad9617a32ca502392d19

SHA1
bef2f2bd58e024d1fecc9a46c327464fd548235d

SHA256
0a03f497a6f7de3ce2e8788a2584c0b169de54d7f1ad4d266dea47e7c7249a0a

SHA512
b80dab8ced697f20157c67853ce4c5dcbd46bc151ba14f7dcf3a2d272a547fbdfc12dcd19dda07f6492f6039af232f050aaa14ebb18774f27d3c75e7a31518c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\6c3fb7d2eb7b41d90b1c0fbccd2ebcf1A.ini

Filesize
1KB

MD5
1b70cd4263d0a8895508e29b6f9345a1

SHA1
26831620e8f1adbf7977edb265b8060ee60b2e86

SHA256
0966f13fa9b1bfbb6bc5952f66a1d9c48b38d7e5c21261f5b5e9a6a6c41f4441

SHA512
a8ef5f22b88e67775b779ea1bd47d5d035467c9018ad2cbc9121dd26580dd0822461b1e08006053aa58ab019db954b826d72825c2c6701e4ec5cdf4fbc4d5f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\8ad40a84a1ab816fda0ea7162ac4322eed5649971bd1388c0269fe315d94a36b.exepack.tmp

Filesize
2KB

MD5
814ac4d365041b4a44189a06f5fcc3be

SHA1
0a3809ae56fc40a837521efc5e26caf974e4c616

SHA256
6c557d45870a330a766a29d6a6f94775c303d7c9d6b1e6afc36bd63541ff4c0c

SHA512
68b5dde03e0cfcac463c884b5fdc0974a2060f4cfd1ea7337e481699cc28367a9b3a25e4ddcdf0bc7fc79cded415e6e1db26d40e30b141073e80a2f76cec5f29

Download Submit
memory/3120-0-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/3120-1-0x0000000002370000-0x0000000002373000-memory.dmp

Filesize
12KB

Download
memory/3120-2-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/3120-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/3120-347-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/3120-348-0x0000000002370000-0x0000000002373000-memory.dmp

Filesize
12KB

Download
memory/3120-356-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/3120-368-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download