Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 11:42

General

  • Target

    895c802177abbd362b58479798f1111c.exe

  • Size

    1003KB

  • MD5

    895c802177abbd362b58479798f1111c

  • SHA1

    2f432ec61a18ee555cc933622b43a4bdea0bd6e2

  • SHA256

    2f8bbcd21805f0cb3e7b69ec9e5b4277885f403bf1d278ae6248965d2730ba79

  • SHA512

    5bd16060fb4ab6a383406120eef6b55693fcc369c586bff39c88d667b4ca027a7b3f10548319a2917bd1cc6002133810e36a95e476127042fd4a66942871b014

  • SSDEEP

    24576:aBE3RgOv7NT+70QagZ9PHJEuMlSVj21RaBkoXlq:CnOzNT+70Q3Z9PHJEuMlSVj21RaBkoXl

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 17 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe
    "C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe
      C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe" /TN xWvB9PLxff3d /F
        3⤵
        • Creates scheduled task(s)
        PID:1524
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN xWvB9PLxff3d > C:\Users\Admin\AppData\Local\Temp\RDs11.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1988
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 616
        3⤵
        • Program crash
        PID:1096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 604
        3⤵
        • Program crash
        PID:4476
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 708
        3⤵
        • Program crash
        PID:756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 656
        3⤵
        • Program crash
        PID:220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 656
        3⤵
        • Program crash
        PID:1184
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 740
        3⤵
        • Program crash
        PID:1348
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1464
        3⤵
        • Program crash
        PID:4960
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1920
        3⤵
        • Program crash
        PID:3116
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2144
        3⤵
        • Program crash
        PID:4652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1936
        3⤵
        • Program crash
        PID:3360
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2140
        3⤵
        • Program crash
        PID:4988
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1920
        3⤵
        • Program crash
        PID:1096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2200
        3⤵
        • Program crash
        PID:4476
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2140
        3⤵
        • Program crash
        PID:2352
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2196
        3⤵
        • Program crash
        PID:856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2156
        3⤵
        • Program crash
        PID:2752
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 568
        3⤵
        • Program crash
        PID:4044
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3060 -ip 3060
    1⤵
      PID:4744
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Query /XML /TN xWvB9PLxff3d
      1⤵
        PID:1480
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3060 -ip 3060
        1⤵
          PID:3676
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3060 -ip 3060
          1⤵
            PID:1572
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3060 -ip 3060
            1⤵
              PID:1440
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3060 -ip 3060
              1⤵
                PID:2628
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3060 -ip 3060
                1⤵
                  PID:4596
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3060 -ip 3060
                  1⤵
                    PID:644
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3060 -ip 3060
                    1⤵
                      PID:4220
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3060 -ip 3060
                      1⤵
                        PID:2296
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3060 -ip 3060
                        1⤵
                          PID:2008
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3060 -ip 3060
                          1⤵
                            PID:4608
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3060 -ip 3060
                            1⤵
                              PID:4508
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3060 -ip 3060
                              1⤵
                                PID:4660
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3060 -ip 3060
                                1⤵
                                  PID:1440
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3060 -ip 3060
                                  1⤵
                                    PID:3512
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3060 -ip 3060
                                    1⤵
                                      PID:4364
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3060 -ip 3060
                                      1⤵
                                        PID:2388

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe

                                        Filesize

                                        7KB

                                        MD5

                                        d3804dc0c30ea751602e1b7a16963769

                                        SHA1

                                        2b929ba1177bb7e873ec0bdb02161267b29041fe

                                        SHA256

                                        28def381ba4fc1ac7de5afd6b3ab4928407497eb9bf399c060544f4c5de9d783

                                        SHA512

                                        eb12fb1d4e2fb2ca6b9881eb936098fdc820283ddcbdc20eaa0c3c3e5c0f106724a432ba9932f426b17621449a1fa98e6bf6c1b2690fe9976e77e878f57173fc

                                      • C:\Users\Admin\AppData\Local\Temp\RDs11.xml

                                        Filesize

                                        1KB

                                        MD5

                                        87fea99532ab781cab3f3cb68dc1b7f0

                                        SHA1

                                        b3f37794f7a833a0aa415ffdfef1b252c1947860

                                        SHA256

                                        7ba1ba4f4c5c2018b8b31a5da106721a1cbb5e758980d55e469f51aa7e5d7777

                                        SHA512

                                        f2b23c033f1b7104898d60cbdf3889062ef8392e3ad7ddf9fb2cab9746b3d6397c17c1e2d4a06082ff55cc0700be10dfc70d8ebb6c2c60cac701ca2bdb767021

                                      • memory/3060-17-0x0000000000400000-0x000000000065C000-memory.dmp

                                        Filesize

                                        2.4MB

                                      • memory/3060-23-0x0000000000400000-0x000000000045B000-memory.dmp

                                        Filesize

                                        364KB

                                      • memory/3060-22-0x0000000000470000-0x00000000004DB000-memory.dmp

                                        Filesize

                                        428KB

                                      • memory/3060-15-0x0000000001720000-0x000000000179E000-memory.dmp

                                        Filesize

                                        504KB

                                      • memory/3060-40-0x0000000000400000-0x000000000065C000-memory.dmp

                                        Filesize

                                        2.4MB

                                      • memory/4420-0-0x0000000000400000-0x000000000065C000-memory.dmp

                                        Filesize

                                        2.4MB

                                      • memory/4420-3-0x0000000025020000-0x000000002509E000-memory.dmp

                                        Filesize

                                        504KB

                                      • memory/4420-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                      • memory/4420-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB