b6bae6843199d8bf511109cdd91a268241af59928cec30e71d864f7212a1b6ed

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

602b33fd3fd862c03dbf7287867c4aca.exe
Size

23KB
MD5

602b33fd3fd862c03dbf7287867c4aca
SHA1

0e644238f78028d99ca0151a14b1593d016789fb
SHA256

b6bae6843199d8bf511109cdd91a268241af59928cec30e71d864f7212a1b6ed
SHA512

a0964c5f91441ae8226cf5c8fbdc9e2428ec0f0c6071b4377ba1fca8ed1753c4c27578d57cc78ffc0191bea485658c13f16862c94acc79a70779060bc65ca525
SSDEEP

384:bULEYdLxr5K6TL5xkfrbcyRDhxKWhjkBfz+NhF5OomvoFtlZmEZB7UliEH9KLD0e:YLEKxXL5YVhUCPF5YmaEZtUliEH9YD0e

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1848	2268	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	602b33fd3fd862c03dbf7287867c4aca.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1848	2268	602b33fd3fd862c03dbf7287867c4aca.exe	28
PID 2268 wrote to memory of 1848	2268	602b33fd3fd862c03dbf7287867c4aca.exe	28
PID 2268 wrote to memory of 1848	2268	602b33fd3fd862c03dbf7287867c4aca.exe	28
PID 2268 wrote to memory of 1848	2268	602b33fd3fd862c03dbf7287867c4aca.exe	28

C:\Users\Admin\AppData\Local\Temp\602b33fd3fd862c03dbf7287867c4aca.exe
"C:\Users\Admin\AppData\Local\Temp\602b33fd3fd862c03dbf7287867c4aca.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1036
  2⤵
  - Program crash
  PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000001060000-0x000000000106A000-memory.dmp

Filesize
40KB

Download
memory/2268-1-0x0000000074A60000-0x000000007514E000-memory.dmp

Filesize
6.9MB

Download
memory/2268-2-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/2268-3-0x0000000074A60000-0x000000007514E000-memory.dmp

Filesize
6.9MB

Download
memory/2268-4-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download