Analysis

  • max time kernel
    91s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231201-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2023 04:27

General

  • Target

    SecuriteInfo.com.FileRepMalware.29201.26455.exe

  • Size

    406KB

  • MD5

    ba8e505b076679d9c2eff327cc6bd353

  • SHA1

    e46554f336d8c8f3cd720298ceaa46d528275669

  • SHA256

    b894cc268212c515d0ee2d531128f79ef1b3131b6ea41a297d1b54f23dcdecca

  • SHA512

    04f0368f58dc5411323d1f4a336d3b4a5ddb601491ecceac557ec143244d43fc20bc5eccdc1dd02b05e625d250bb38f2e881533c5c219959067473546b4024d8

  • SSDEEP

    12288:BRuXX7/8PoKqO7tV3Ebtp+EPbEoBW+i0b:BgX7UPr7n3EZTE6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.29201.26455.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.29201.26455.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Users\Admin\AppData\Local\Temp\hzwno.exe
      "C:\Users\Admin\AppData\Local\Temp\hzwno.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Users\Admin\AppData\Local\Temp\hzwno.exe
        "C:\Users\Admin\AppData\Local\Temp\hzwno.exe"
        3⤵
          PID:2012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 692
          3⤵
          • Program crash
          PID:372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2628 -ip 2628
      1⤵
        PID:3064

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\hzwno.exe

        Filesize

        167KB

        MD5

        4b85a8e213135cf1c7f0c0a5e5265d51

        SHA1

        3e4db8171578ebbe4a9c8350e20e7136a0cee46d

        SHA256

        c3f9831ef39bbda2e01282a555b500ad8088abb358a633e2a2513c4f18768554

        SHA512

        b6d3a8334babda44c7aee88b866434e07914e134ca6a70793966d8ebf4a1c8463884ffe4afd171dbd6634888bd716126c9d2864eb98dd8ad249f34ec6d2b3cd2

      • C:\Users\Admin\AppData\Local\Temp\hzwno.exe

        Filesize

        167KB

        MD5

        4b85a8e213135cf1c7f0c0a5e5265d51

        SHA1

        3e4db8171578ebbe4a9c8350e20e7136a0cee46d

        SHA256

        c3f9831ef39bbda2e01282a555b500ad8088abb358a633e2a2513c4f18768554

        SHA512

        b6d3a8334babda44c7aee88b866434e07914e134ca6a70793966d8ebf4a1c8463884ffe4afd171dbd6634888bd716126c9d2864eb98dd8ad249f34ec6d2b3cd2

      • C:\Users\Admin\AppData\Local\Temp\rxwdyqzxsb.tox

        Filesize

        334KB

        MD5

        21d440c7609b7b15ef571c81da11e000

        SHA1

        7dbb91fad91b178b8bbcb58745add49b332f6464

        SHA256

        766ed137fedabe6d85f356040fce66454282c6c9f0e958fe9fdaefb3285634fe

        SHA512

        c302bfd4b05d5652b77e239405d25c9987565e3020a502e75bd4c85c2ad4bd0e251ec8f1f9996147fe0b0c823946e6f87c9c6a87f0ce3fa616184d601e79fead

      • memory/2628-5-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB