Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2023, 23:50

General

  • Target

    057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe

  • Size

    646KB

  • MD5

    d569c4642597d5b883b3ae598bcc19b3

  • SHA1

    7b8fa0006d9a7dc803eb1dd5c2ab2b4314942001

  • SHA256

    057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910

  • SHA512

    8dfb4d6280de31e2183a19ed790626485004d66a2b85d2dc3312b06a05cd47fe82add4e64d417709a38ea28ee7c3f0275af90fd1534857b5be643ea4d709ebe6

  • SSDEEP

    12288:3uP4KRi4cu659UrnsLoaEYkTOKKvnZzxoYYxj9eKjRKvYqg:iJRik65iwuYZ1oYgi1

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
    "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
      "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
      2⤵
        PID:4324
      • C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
        "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4320
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 184
          3⤵
          • Program crash
          PID:4412
      • C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
        "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
        2⤵
          PID:3648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4320 -ip 4320
        1⤵
          PID:1280

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4320-10-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/4320-16-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/4320-14-0x00000000013A0000-0x00000000016EA000-memory.dmp

          Filesize

          3.3MB

        • memory/4572-4-0x00000000031C0000-0x00000000031D0000-memory.dmp

          Filesize

          64KB

        • memory/4572-0-0x00000000749A0000-0x0000000075150000-memory.dmp

          Filesize

          7.7MB

        • memory/4572-5-0x00000000056B0000-0x00000000056BA000-memory.dmp

          Filesize

          40KB

        • memory/4572-6-0x0000000005930000-0x0000000005946000-memory.dmp

          Filesize

          88KB

        • memory/4572-7-0x0000000005940000-0x000000000594A000-memory.dmp

          Filesize

          40KB

        • memory/4572-8-0x0000000006ED0000-0x0000000006F4C000-memory.dmp

          Filesize

          496KB

        • memory/4572-9-0x0000000009510000-0x00000000095AC000-memory.dmp

          Filesize

          624KB

        • memory/4572-11-0x00000000749A0000-0x0000000075150000-memory.dmp

          Filesize

          7.7MB

        • memory/4572-12-0x00000000031C0000-0x00000000031D0000-memory.dmp

          Filesize

          64KB

        • memory/4572-3-0x00000000056C0000-0x0000000005752000-memory.dmp

          Filesize

          584KB

        • memory/4572-15-0x00000000749A0000-0x0000000075150000-memory.dmp

          Filesize

          7.7MB

        • memory/4572-2-0x0000000005D50000-0x00000000062F4000-memory.dmp

          Filesize

          5.6MB

        • memory/4572-1-0x0000000000C00000-0x0000000000CA8000-memory.dmp

          Filesize

          672KB