3f490362db7a369ba1ce7693425e5a0c841c549797022658d7bb94a082011c33

Analysis

max time kernel
0s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24ab578c2502650cd3cd0b129f53056b.exe
Size

505KB
MD5

24ab578c2502650cd3cd0b129f53056b
SHA1

c0af7027f89751406a9bb21d14e4b7823b41f8c5
SHA256

3f490362db7a369ba1ce7693425e5a0c841c549797022658d7bb94a082011c33
SHA512

2298493510474c35896e5615d65770a259bfd0fad86fbe117699fb471e8657f2428d7d5562652051c1ec8e6521c150890354b7a8a80ef1e71c1e286b4e8e8c5c
SSDEEP

12288:/zy6rRxEHdjDblNMi7Vhdyr1gqfZRqK6JVd/Ml4i/2ZBRdOFcbG/o:e6rTkRblLwqqfZRVUVd/NrBRs2bd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
4532	4396	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\24ab578c2502650cd3cd0b129f53056b.exe
"C:\Users\Admin\AppData\Local\Temp\24ab578c2502650cd3cd0b129f53056b.exe"
1⤵
PID:540
- C:\Users\Admin\AppData\Local\Temp\ysf.exe
  "C:\Users\Admin\AppData\Local\Temp\ysf.exe"
  2⤵
  PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4396 -ip 4396
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 224
1⤵
- Program crash
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ysf.exe

Filesize
24KB

MD5
401cd4e5dac275f5a1a8065a01607699

SHA1
1e4e90ad38d2b85d417311bc5d1e0d36dc6875f7

SHA256
b342c9569a99a9de842a608dc4ffd6c0fe85c24f0dca3dcb0c79b4d3aff34643

SHA512
46cc4c7ee4c7f3026a1fceb70d6f7bdc1a4d1a1f76dde5bdbe915b03b9d57df9906a542ffe4afad38b420b5d5e72da03b93a1af946e51b4b88252f3edea78920

Download Submit
memory/540-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4396-18-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4396-21-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download