Analysis
-
max time kernel
142s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
02-11-2023 01:54
General
-
Target
5c325cee3f9b498ebb58368772124a80.exe
-
Size
37KB
-
MD5
5c325cee3f9b498ebb58368772124a80
-
SHA1
d5ef0d2717e49979642d54997795f19744b5eec0
-
SHA256
10a8e1c15fa361be35bf0e16c7372aa7e873b7fa252ac5c6dcdd84f96e53221b
-
SHA512
5bccb28d1cf2f88990420bbfb32b66237cf9e7c368c14d9930925fb4b68eb6109bd03a9ebd7a48ce1cdebd3ae2d3b28fbee86f647316d051dc061b40752f0df3
-
SSDEEP
384:8fjWiErk7Hw/5LYou/bQPpsm8U9dfmH97nI8Pc5:8WiEg7QhLYrQsJAmdDI8Pc
Score
10/10
Malware Config
Signatures
-
Gink
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Drops file in Windows directory 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c325cee3f9b498ebb58368772124a80.exe"C:\Users\Admin\AppData\Local\Temp\5c325cee3f9b498ebb58368772124a80.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 5242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2024 -ip 20241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-0-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2024-4-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2024-8-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB