Analysis

  • max time kernel
    164s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2023 20:12

General

  • Target

    02ae8736611d3bccc120e3579bdd76df.exe

  • Size

    501KB

  • MD5

    02ae8736611d3bccc120e3579bdd76df

  • SHA1

    1048439bd12d6837aafd04fb61efbb5d766fb8b1

  • SHA256

    4a5e747ae28948df4bf3c7fa2d249c0f8dd39dfdde9a733b69ae6a6ad383f2c2

  • SHA512

    69ce18d017e7e26fded9212a03cc5a03a5bbb12a1175ea479336d85ada6e0f485cf6ba877d182fcd373fce73fdf30b7a73c2578b1cfd45cdeaae2ac7c1252aa8

  • SSDEEP

    12288:wkAOVOhk1KsO+z+fVI1iGTfuMV6I9k9h8bIC:w82sHSfsi2V6Ia9h8bx

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 17 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe
    "C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe
      C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe" /TN 91YuFL8m6860 /F
        3⤵
        • Creates scheduled task(s)
        PID:2120
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN 91YuFL8m6860 > C:\Users\Admin\AppData\Local\Temp\fnZgBB.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN 91YuFL8m6860
          4⤵
            PID:3260
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 616
          3⤵
          • Program crash
          PID:5040
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 652
          3⤵
          • Program crash
          PID:3580
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 660
          3⤵
          • Program crash
          PID:1432
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 732
          3⤵
          • Program crash
          PID:3872
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 748
          3⤵
          • Program crash
          PID:1852
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 756
          3⤵
          • Program crash
          PID:1628
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1456
          3⤵
          • Program crash
          PID:4036
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1872
          3⤵
          • Program crash
          PID:3324
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 2144
          3⤵
          • Program crash
          PID:2672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1924
          3⤵
          • Program crash
          PID:936
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1880
          3⤵
          • Program crash
          PID:1256
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1468
          3⤵
          • Program crash
          PID:3776
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 892
          3⤵
          • Program crash
          PID:692
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 2124
          3⤵
          • Program crash
          PID:3836
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1952
          3⤵
          • Program crash
          PID:3124
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 2140
          3⤵
          • Program crash
          PID:2640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 664
          3⤵
          • Program crash
          PID:1284
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4864 -ip 4864
      1⤵
        PID:4772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4864 -ip 4864
        1⤵
          PID:1768
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4864 -ip 4864
          1⤵
            PID:3568
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4864 -ip 4864
            1⤵
              PID:5080
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4864 -ip 4864
              1⤵
                PID:1528
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4864 -ip 4864
                1⤵
                  PID:3092
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4864 -ip 4864
                  1⤵
                    PID:4404
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4864 -ip 4864
                    1⤵
                      PID:4560
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4864 -ip 4864
                      1⤵
                        PID:2200
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4864 -ip 4864
                        1⤵
                          PID:4580
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4864 -ip 4864
                          1⤵
                            PID:3920
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4864 -ip 4864
                            1⤵
                              PID:4716
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4864 -ip 4864
                              1⤵
                                PID:3532
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4864 -ip 4864
                                1⤵
                                  PID:3112
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4864 -ip 4864
                                  1⤵
                                    PID:2128
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4864 -ip 4864
                                    1⤵
                                      PID:4312
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4864 -ip 4864
                                      1⤵
                                        PID:3340

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe

                                        Filesize

                                        462KB

                                        MD5

                                        333485cb2da6d79b58aa40edd71672d5

                                        SHA1

                                        1ae2bd797e1ed2bac8624c11036339e73e16acb2

                                        SHA256

                                        f01c46114e5ed90a13b97a0f1184917379a308d555530566ee242f91f7b8d792

                                        SHA512

                                        8e31ccfe65b32efacb74817eabf34c0ba1aaefcacbda5016816c1a59db0fbf73df3807ca69e2847f65b5df44af24aca35c9bef07ece040babc3b57186bff25b7

                                      • C:\Users\Admin\AppData\Local\Temp\fnZgBB.xml

                                        Filesize

                                        1KB

                                        MD5

                                        57f1280d17b0ef2da57e80b79509a9ed

                                        SHA1

                                        4a71ef8842d2ed809448a744714bb7579fe5d665

                                        SHA256

                                        3868abdcf4cb4619a5459a7aec3cda1acde4bafd29403b4cef782f38d06c9996

                                        SHA512

                                        30635d3b20ffcb127a7e97c225f60a5b78e46d0f2dcf17bce716b6fafdce7e72f621f1ed105aa581268ff0e95f08babcc3916b727f1610fdc668fb73698716cc

                                      • memory/4636-0-0x0000000000400000-0x000000000065C000-memory.dmp

                                        Filesize

                                        2.4MB

                                      • memory/4636-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                      • memory/4636-2-0x0000000025010000-0x000000002508E000-memory.dmp

                                        Filesize

                                        504KB

                                      • memory/4636-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                      • memory/4864-14-0x0000000000400000-0x000000000065C000-memory.dmp

                                        Filesize

                                        2.4MB

                                      • memory/4864-17-0x0000000001730000-0x00000000017AE000-memory.dmp

                                        Filesize

                                        504KB

                                      • memory/4864-22-0x0000000000470000-0x00000000004DB000-memory.dmp

                                        Filesize

                                        428KB

                                      • memory/4864-23-0x0000000000400000-0x000000000045B000-memory.dmp

                                        Filesize

                                        364KB

                                      • memory/4864-34-0x0000000000400000-0x000000000065C000-memory.dmp

                                        Filesize

                                        2.4MB