0b40111b35548720254f142c4bd7bf28b4c0731d2cfbea1e861fccb4293ee56d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

373c443e05b8f481f26e647fd2a2835b.exe
Size

193KB
MD5

373c443e05b8f481f26e647fd2a2835b
SHA1

df453d345ea377d2c35c55879fb4cbac90cb45e9
SHA256

0b40111b35548720254f142c4bd7bf28b4c0731d2cfbea1e861fccb4293ee56d
SHA512

64fb570db03ab3b48d6cacea9c834af3da359bf2057d976a50fc92144c24b5a6b0230234ad7823d34357e9a2bd0718b986ac8f9fe9f0057ef84e40b1300a60e6
SSDEEP

3072:uSHUaEzbFlpqn4Xb3GreTIRsAU4k3713xRlyRXXel31+dyBE:uSHwzbFWGb3QZRruBcRS0dyB

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1752	windefender.exe

Loads dropped DLL 6 IoCs

pid	Process
1732	373c443e05b8f481f26e647fd2a2835b.exe
1732	373c443e05b8f481f26e647fd2a2835b.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\windefender = "C:\\Users\\Admin\\AppData\\Roaming\\Installed\\windefender.exe"	373c443e05b8f481f26e647fd2a2835b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1752	windefender.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1752	1732	373c443e05b8f481f26e647fd2a2835b.exe	28
PID 1732 wrote to memory of 1752	1732	373c443e05b8f481f26e647fd2a2835b.exe	28
PID 1732 wrote to memory of 1752	1732	373c443e05b8f481f26e647fd2a2835b.exe	28
PID 1752 wrote to memory of 1220	1752	windefender.exe	13
PID 1220 wrote to memory of 2196	1220	Explorer.EXE	29
PID 1220 wrote to memory of 2196	1220	Explorer.EXE	29
PID 1220 wrote to memory of 2196	1220	Explorer.EXE	29
PID 1752 wrote to memory of 2184	1752	windefender.exe	30
PID 1752 wrote to memory of 2184	1752	windefender.exe	30
PID 1752 wrote to memory of 2184	1752	windefender.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\373c443e05b8f481f26e647fd2a2835b.exe
  "C:\Users\Admin\AppData\Local\Temp\373c443e05b8f481f26e647fd2a2835b.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Roaming\Installed\windefender.exe
    "C:\Users\Admin\AppData\Roaming\Installed\windefender.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1752 -s 252
      4⤵
      Loads dropped DLL
      PID:2184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1220 -s 1760
  2⤵
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Installed\windefender.exe

Filesize
193KB

MD5
373c443e05b8f481f26e647fd2a2835b

SHA1
df453d345ea377d2c35c55879fb4cbac90cb45e9

SHA256
0b40111b35548720254f142c4bd7bf28b4c0731d2cfbea1e861fccb4293ee56d

SHA512
64fb570db03ab3b48d6cacea9c834af3da359bf2057d976a50fc92144c24b5a6b0230234ad7823d34357e9a2bd0718b986ac8f9fe9f0057ef84e40b1300a60e6

Download Submit
C:\Users\Admin\AppData\Roaming\ntkrnl

Filesize
193KB

MD5
1c423b8f0c730d1fe77bbb10ad740fa7

SHA1
9260775a0000f4acf726c32e2f7ea440f55ea315

SHA256
487645fb22016a97836f5c89ebd14838083e10d3a8d4b28eea97f413b1b4c7f1

SHA512
7e43f8b6c876db8182a205d2051d7c2fd38aa74bfdc83867f9ee051b55b85e32c98eb80faf8d259508d041ba0dd3eed404d11236a0de60e00383d9e13144c015

Download Submit
memory/1220-12-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1220-13-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download