Overview
overview
10Static
static
10сентя...49.exe
windows7-x64
10сентя...49.exe
windows10-2004-x64
10сентя...df.exe
windows7-x64
10сентя...df.exe
windows10-2004-x64
10сентя...5d.exe
windows7-x64
8сентя...5d.exe
windows10-2004-x64
8сентя...ba.exe
windows7-x64
10сентя...ba.exe
windows10-2004-x64
10сентя...bd.exe
windows7-x64
7сентя...bd.exe
windows10-2004-x64
7сентя...14.exe
windows7-x64
3сентя...14.exe
windows10-2004-x64
3сентя...04.exe
windows7-x64
10сентя...04.exe
windows10-2004-x64
10сентя...73.exe
windows7-x64
10сентя...73.exe
windows10-2004-x64
сентя...4b.exe
windows7-x64
1сентя...4b.exe
windows10-2004-x64
10сентя...ee.exe
windows7-x64
3сентя...ee.exe
windows10-2004-x64
7сентя...75.exe
windows7-x64
3сентя...75.exe
windows10-2004-x64
7сентя...53.exe
windows7-x64
10сентя...53.exe
windows10-2004-x64
сентя...fa.exe
windows7-x64
10сентя...fa.exe
windows10-2004-x64
10сентя...e3.exe
windows7-x64
10сентя...e3.exe
windows10-2004-x64
10сентя...3a.exe
windows7-x64
3сентя...3a.exe
windows10-2004-x64
3сентя...25.exe
windows7-x64
10сентя...25.exe
windows10-2004-x64
10Analysis
-
max time kernel
39s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 02:04
Static task
static1
Behavioral task
behavioral1
Sample
сентябрь 2023(570)/00053bf64ec3040b73c84979799768dba9a03c5f0d2f73512977c7030e29dd49.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
сентябрь 2023(570)/00053bf64ec3040b73c84979799768dba9a03c5f0d2f73512977c7030e29dd49.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
сентябрь 2023(570)/00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819df.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
сентябрь 2023(570)/00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819df.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
сентябрь 2023(570)/0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
сентябрь 2023(570)/0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
сентябрь 2023(570)/01e5ebc2c096d465800660a0ad6d62208a5b2b675e3700f3734fac225b1d38bd.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
сентябрь 2023(570)/01e5ebc2c096d465800660a0ad6d62208a5b2b675e3700f3734fac225b1d38bd.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
сентябрь 2023(570)/01fc4ee8bd9cd9c2ee70ccd486f4f3d1fdd42f40fffc6ab66e9f3973f2000e14.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
сентябрь 2023(570)/01fc4ee8bd9cd9c2ee70ccd486f4f3d1fdd42f40fffc6ab66e9f3973f2000e14.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
сентябрь 2023(570)/036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
сентябрь 2023(570)/036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
сентябрь 2023(570)/045cbc9ff518aa3bf58f568868c326af3ea7dea491e2543233885ecbaec30eee.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
сентябрь 2023(570)/045cbc9ff518aa3bf58f568868c326af3ea7dea491e2543233885ecbaec30eee.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
сентябрь 2023(570)/0651c1ebd22042c0f18964dcf445e7b4f350b2d7d01413040860a2187fdea5e3.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
сентябрь 2023(570)/0651c1ebd22042c0f18964dcf445e7b4f350b2d7d01413040860a2187fdea5e3.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
Resource
win10v2004-20231215-en
General
-
Target
сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe
-
Size
609KB
-
MD5
725cf8ad8ed8f096e03cd373c8abde91
-
SHA1
c8fa598234529b94280bdb8fceeeeafe326f9575
-
SHA256
057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75
-
SHA512
52bed1b613f897e6354b1c05d55880400937f288c8a7e32a3d4c15ce58e1efe25f7889114ccaf46626141491b862cfbb6f896c49ae200e686c70797617a07f8a
-
SSDEEP
12288:ICn9t5725IAGZ64fzBt3hQJ0FyqNI6EO96f4zU2c1MlBBW75NJiaxmwS:ICEQk4VzQJvqNI6vMwzU0XBfaxM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2696 1716 WerFault.exe 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 9922⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OsKZUclncCXlX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OsKZUclncCXlX.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmpMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1716-6-0x0000000000330000-0x000000000033C000-memory.dmpFilesize
48KB
-
memory/1716-0-0x0000000000220000-0x00000000002BE000-memory.dmpFilesize
632KB
-
memory/1716-3-0x0000000000300000-0x0000000000310000-memory.dmpFilesize
64KB
-
memory/1716-4-0x0000000074830000-0x0000000074F1E000-memory.dmpFilesize
6.9MB
-
memory/1716-5-0x0000000004D60000-0x0000000004DA0000-memory.dmpFilesize
256KB
-
memory/1716-1-0x0000000074830000-0x0000000074F1E000-memory.dmpFilesize
6.9MB
-
memory/1716-7-0x0000000005800000-0x000000000587C000-memory.dmpFilesize
496KB
-
memory/1716-2-0x0000000004D60000-0x0000000004DA0000-memory.dmpFilesize
256KB
-
memory/2864-17-0x000000006EB90000-0x000000006F13B000-memory.dmpFilesize
5.7MB
-
memory/2864-19-0x00000000029A0000-0x00000000029E0000-memory.dmpFilesize
256KB
-
memory/2864-18-0x00000000029A0000-0x00000000029E0000-memory.dmpFilesize
256KB
-
memory/2864-16-0x00000000029A0000-0x00000000029E0000-memory.dmpFilesize
256KB
-
memory/2864-15-0x000000006EB90000-0x000000006F13B000-memory.dmpFilesize
5.7MB
-
memory/2864-20-0x000000006EB90000-0x000000006F13B000-memory.dmpFilesize
5.7MB