592d65a129ea21b3057c5858ca2bc2956683e866b885c7fe6841384e0f16ace2

Analysis

max time kernel
154s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c8387826db6309f2c6e15cb274ad88f.exe
Size

537KB
MD5

0c8387826db6309f2c6e15cb274ad88f
SHA1

856a60e706ae281e9c0c6e2f9612abc1f0713934
SHA256

592d65a129ea21b3057c5858ca2bc2956683e866b885c7fe6841384e0f16ace2
SHA512

5349c9ed80e3185666a9fc6e2e4a11a9d1042b4e59174f061589b1f282098ef2a06da80cb11c499154a51d57ef14c7c2b40084f40bc710785a83b477ebb72096
SSDEEP

12288:3YslGFIr57MHz+P0IrQ7I1pspond41HQo30veSBiQPp4kv8ga:9lmyMT08M1G+d3RGELPpFU9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4212	EntMian.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	0c8387826db6309f2c6e15cb274ad88f.exe
File created	C:\Windows\EntMian.exe	0c8387826db6309f2c6e15cb274ad88f.exe
File opened for modification	C:\Windows\EntMian.exe	0c8387826db6309f2c6e15cb274ad88f.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2876	688	WerFault.exe	91
1628	4212	WerFault.exe	97

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	0c8387826db6309f2c6e15cb274ad88f.exe
Token: SeDebugPrivilege	4212	EntMian.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4212	EntMian.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4188	4212	EntMian.exe	105
PID 4212 wrote to memory of 4188	4212	EntMian.exe	105
PID 688 wrote to memory of 3976	688	0c8387826db6309f2c6e15cb274ad88f.exe	106
PID 688 wrote to memory of 3976	688	0c8387826db6309f2c6e15cb274ad88f.exe	106
PID 688 wrote to memory of 3976	688	0c8387826db6309f2c6e15cb274ad88f.exe	106

C:\Users\Admin\AppData\Local\Temp\0c8387826db6309f2c6e15cb274ad88f.exe
"C:\Users\Admin\AppData\Local\Temp\0c8387826db6309f2c6e15cb274ad88f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 320
  2⤵
  - Program crash
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 688 -ip 688
1⤵
PID:740

C:\Windows\EntMian.exe
C:\Windows\EntMian.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 328
  2⤵
  - Program crash
  PID:1628
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4212 -ip 4212
1⤵
PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\EntMian.exe

Filesize
537KB

MD5
0c8387826db6309f2c6e15cb274ad88f

SHA1
856a60e706ae281e9c0c6e2f9612abc1f0713934

SHA256
592d65a129ea21b3057c5858ca2bc2956683e866b885c7fe6841384e0f16ace2

SHA512
5349c9ed80e3185666a9fc6e2e4a11a9d1042b4e59174f061589b1f282098ef2a06da80cb11c499154a51d57ef14c7c2b40084f40bc710785a83b477ebb72096

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
d51f7055f57781d22d7c23a606ac99fb

SHA1
b2b11f4377ef739d47df8a488743b7b5a9574c5e

SHA256
4872bb8cc3cd2ba6f6eea677020a91d01e4d4c3db41a5c94db63c79c9db96379

SHA512
655077977d4435bdf1596ce1a3e67d1177751578f26b02b2b776a0922c1b6519020bfda358d2e1e51c9ff3d13b7c90614aef87185c01aaa6209fdd45b1bd1bf5

Download Submit
memory/688-10-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/688-2-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/688-5-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/688-4-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/688-6-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/688-7-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/688-8-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/688-9-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/688-0-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/688-3-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/688-1-0x00000000009F0000-0x0000000000A3B000-memory.dmp

Filesize
300KB

Download
memory/688-16-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/688-19-0x00000000009F0000-0x0000000000A3B000-memory.dmp

Filesize
300KB

Download
memory/688-25-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/4212-21-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/4212-22-0x00000000012F0000-0x00000000012F1000-memory.dmp

Filesize
4KB

Download
memory/4212-20-0x00000000009F0000-0x0000000000A3B000-memory.dmp

Filesize
300KB

Download
memory/4212-15-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/4212-28-0x00000000012F0000-0x00000000012F1000-memory.dmp

Filesize
4KB

Download