22a0a69fa36d98e48723ad92a10491b6abf198e4d114c6902358e6ffc736e5aa

Analysis

max time kernel
142s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56fab7dc0dfe1673295bed79543af36e.exe
Size

117KB
MD5

56fab7dc0dfe1673295bed79543af36e
SHA1

8f1684507c3c08f26dea7d06bf4acac4764dac3a
SHA256

22a0a69fa36d98e48723ad92a10491b6abf198e4d114c6902358e6ffc736e5aa
SHA512

02db9b41c3642e9e1caba7fc5c7af9fc138564950a113320ac5d936f96c13b9f79dd1b942c5a8abc07d63043c09e3e75a7d8ab0950140d7ab5e05efcb58aa2a7
SSDEEP

1536:PCOV9tYASQmsuPbFuy3PTyZubtmi1OvjO+UMjsJcFscNsWjcdTmZGCdj7wVYU6Z:6etYTQ0puy3Pzm0+FxyCZGGjMVYh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	3732	WerFault.exe	12

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3732	56fab7dc0dfe1673295bed79543af36e.exe
3732	56fab7dc0dfe1673295bed79543af36e.exe

C:\Users\Admin\AppData\Local\Temp\56fab7dc0dfe1673295bed79543af36e.exe
"C:\Users\Admin\AppData\Local\Temp\56fab7dc0dfe1673295bed79543af36e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1268
  2⤵
  - Program crash
  PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3732 -ip 3732
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...