b6bae6843199d8bf511109cdd91a268241af59928cec30e71d864f7212a1b6ed

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

602b33fd3fd862c03dbf7287867c4aca.exe
Size

23KB
MD5

602b33fd3fd862c03dbf7287867c4aca
SHA1

0e644238f78028d99ca0151a14b1593d016789fb
SHA256

b6bae6843199d8bf511109cdd91a268241af59928cec30e71d864f7212a1b6ed
SHA512

a0964c5f91441ae8226cf5c8fbdc9e2428ec0f0c6071b4377ba1fca8ed1753c4c27578d57cc78ffc0191bea485658c13f16862c94acc79a70779060bc65ca525
SSDEEP

384:bULEYdLxr5K6TL5xkfrbcyRDhxKWhjkBfz+NhF5OomvoFtlZmEZB7UliEH9KLD0e:YLEKxXL5YVhUCPF5YmaEZtUliEH9YD0e

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1084	4064	WerFault.exe	14

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	602b33fd3fd862c03dbf7287867c4aca.exe

C:\Users\Admin\AppData\Local\Temp\602b33fd3fd862c03dbf7287867c4aca.exe
"C:\Users\Admin\AppData\Local\Temp\602b33fd3fd862c03dbf7287867c4aca.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 1732
  2⤵
  - Program crash
  PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4064 -ip 4064
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4064-1-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4064-0-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/4064-2-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/4064-3-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download