eca5131a2a2568d4471f8dffde68153f2504694be5bfe6b895a7e19a3885753d

Analysis

max time kernel
102s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2023, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6106eadef2eb944c12ddf37279f4a235f619c4c261b0195c89ab835737ed4f9b.exe
Size

344KB
MD5

a8e7f3a15d1e285a976bb777d97d45c6
SHA1

d851ed7990d90e4bcfe9613481f4a026a227921a
SHA256

6106eadef2eb944c12ddf37279f4a235f619c4c261b0195c89ab835737ed4f9b
SHA512

229a89b54600b2eaf5666a99b3822ccbfccbfa8632a62480fc3c9cdf01e51369939e625d7808a5cb50c7a251741733ae7fc6c5312540d2c68beef3f1428d17e1
SSDEEP

6144:d24cPHz3yWFC7i2DmauzMdV0kLotZC1Hh87OuPW:0zT3Rv2s/C1hGO3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
720	2704	WerFault.exe	15

Kills process with taskkill 1 IoCs

evasion

pid	Process
5116	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\6106eadef2eb944c12ddf37279f4a235f619c4c261b0195c89ab835737ed4f9b.exe
"C:\Users\Admin\AppData\Local\Temp\6106eadef2eb944c12ddf37279f4a235f619c4c261b0195c89ab835737ed4f9b.exe"
1⤵
PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "6106eadef2eb944c12ddf37279f4a235f619c4c261b0195c89ab835737ed4f9b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\6106eadef2eb944c12ddf37279f4a235f619c4c261b0195c89ab835737ed4f9b.exe" & exit
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "6106eadef2eb944c12ddf37279f4a235f619c4c261b0195c89ab835737ed4f9b.exe" /f
    3⤵
    - Kills process with taskkill
    PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1788
  2⤵
  - Program crash
  PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2704 -ip 2704
1⤵
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-1-0x0000000002410000-0x0000000002510000-memory.dmp

Filesize
1024KB

Download
memory/2704-2-0x0000000003EB0000-0x0000000003EEE000-memory.dmp

Filesize
248KB

Download
memory/2704-3-0x0000000000400000-0x000000000229C000-memory.dmp

Filesize
30.6MB

Download
memory/2704-5-0x0000000000400000-0x000000000229C000-memory.dmp

Filesize
30.6MB

Download
memory/2704-6-0x0000000002410000-0x0000000002510000-memory.dmp

Filesize
1024KB

Download
memory/2704-7-0x0000000003EB0000-0x0000000003EEE000-memory.dmp

Filesize
248KB

Download
memory/2704-8-0x0000000000400000-0x000000000229C000-memory.dmp

Filesize
30.6MB

Download
memory/2704-13-0x0000000000400000-0x000000000229C000-memory.dmp

Filesize
30.6MB

Download