2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2023 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a.exe
Size

11.9MB
MD5

02244e7551f2159524919f8e9aaa1216
SHA1

620dd39a4a2b147d422cc8c7ea24bdd7cfe0968a
SHA256

2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a
SHA512

ba7cc5bf5b75365684fc6698b86c203736ec39522146560a04057b417ca3a4a4893962e6440929fb5daa4c00ee0cb980035e66c083b3c848beebbbe454911f97
SSDEEP

196608:1aiYpD1k9bb2TxAhS+6/xM9qkUvcCht6z3K/uwAn7hQ6lJ8NQTJ2K6Go:oiYpi9ExAIJ/69IvJh4LwAnC6QNQ9/o

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4364	4828	WerFault.exe	82

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4828	2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a.exe
4828	2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a.exe
4828	2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a.exe
4828	2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a.exe

C:\Users\Admin\AppData\Local\Temp\2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a.exe
"C:\Users\Admin\AppData\Local\Temp\2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 2932
  2⤵
  - Program crash
  PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4828 -ip 4828
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2880566c5f8434ed081ae95920bb72412178dc098820b1614c1df281fcad9f1a.exepack.tmp

Filesize
2KB

MD5
814ac4d365041b4a44189a06f5fcc3be

SHA1
0a3809ae56fc40a837521efc5e26caf974e4c616

SHA256
6c557d45870a330a766a29d6a6f94775c303d7c9d6b1e6afc36bd63541ff4c0c

SHA512
68b5dde03e0cfcac463c884b5fdc0974a2060f4cfd1ea7337e481699cc28367a9b3a25e4ddcdf0bc7fc79cded415e6e1db26d40e30b141073e80a2f76cec5f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\faff4d755584b7e2b5c13c7ee84e9bfd.ini

Filesize
1KB

MD5
36b4e800c954e1fd5968fa24303e6d98

SHA1
bd5b081bc80d05fc0307f77e145585baa776b1d9

SHA256
80cc38cdf7a4cf25d64e26e17f12083efa9e95487438490778670f4cb58f4920

SHA512
49384228b72a265365e461c339d756762703edf3669349127cc46c8fc63cb2c59e4bfb5f789d0b0cac185d326741b1baccdf2b9fbf54c1ee4abcd88b651d9748

Download Submit
C:\Users\Admin\AppData\Local\Temp\faff4d755584b7e2b5c13c7ee84e9bfdA.ini

Filesize
1KB

MD5
1b70cd4263d0a8895508e29b6f9345a1

SHA1
26831620e8f1adbf7977edb265b8060ee60b2e86

SHA256
0966f13fa9b1bfbb6bc5952f66a1d9c48b38d7e5c21261f5b5e9a6a6c41f4441

SHA512
a8ef5f22b88e67775b779ea1bd47d5d035467c9018ad2cbc9121dd26580dd0822461b1e08006053aa58ab019db954b826d72825c2c6701e4ec5cdf4fbc4d5f60

Download Submit
memory/4828-0-0x0000000000400000-0x0000000001DB0000-memory.dmp

Filesize
25.7MB

Download
memory/4828-1-0x0000000001F60000-0x0000000001F63000-memory.dmp

Filesize
12KB

Download
memory/4828-2-0x0000000000400000-0x0000000001DB0000-memory.dmp

Filesize
25.7MB

Download
memory/4828-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4828-347-0x0000000000400000-0x0000000001DB0000-memory.dmp

Filesize
25.7MB

Download
memory/4828-351-0x0000000001F60000-0x0000000001F63000-memory.dmp

Filesize
12KB

Download
memory/4828-359-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4828-374-0x0000000000400000-0x0000000001DB0000-memory.dmp

Filesize
25.7MB

Download