Resubmissions
14-11-2023 17:31
231114-v3qg7acf42 1014-11-2023 17:21
231114-vxdw7sdg61 1028-10-2023 19:29
231028-x7cs1age56 1024-10-2023 13:29
231024-qrn3rsdb6z 1018-10-2023 12:04
231018-n8ybnaeb31 1007-09-2023 12:10
230907-pce1wahe2x 10Analysis
-
max time kernel
1574s -
max time network
1539s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
18-10-2023 12:04
General
-
Target
31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe
-
Size
603KB
-
MD5
386ad5036e95b8cbe06967ee2171114e
-
SHA1
c159cf6e8382231043060f647768987dec7505df
-
SHA256
31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff
-
SHA512
5012595611c96f08cf729fac14a3c97417917cbdd18f581f306b65f28b4248d1c8a7ad003e2f1f7aa9695dacfaba18d641ac1f6db1da248be109c18accaa06fd
-
SSDEEP
12288:4xbFLS7NHbRobFSkfg+g3j0viyzQA9F67afYScr80O7Rf:4eRH+5w+o0vEwd0Q08Rf
Malware Config
Signatures
-
Program crash 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe"C:\Users\Admin\AppData\Local\Temp\31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 3842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 5682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 5682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2276 -ip 22761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2276 -ip 22761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2276 -ip 22761⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5eee3df4df84e314ea2e591f5175df304
SHA11546d5026278077aa0f8ca436ae1f78756a05fa4
SHA2562216a26e0c498a8f8a7d0c162f2b70af59e9fff0da1b462bbf21acf28afe92e9
SHA5127aa4610dcdc9735efd74dfeb7eedf47a9798e5010f46759830fdef29d617f82e90c7a223f285225baf4255911362c6a055c5c1b88021c2ee6f60e0b85c0e8d1c
-
Filesize
1.3MB
-
Filesize
284KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
52KB
-
Filesize
492KB
-
Filesize
284KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB