Overview
overview
10Static
static
10сентя...49.exe
windows7-x64
10сентя...49.exe
windows10-2004-x64
10сентя...df.exe
windows7-x64
10сентя...df.exe
windows10-2004-x64
10сентя...5d.exe
windows7-x64
8сентя...5d.exe
windows10-2004-x64
8сентя...ba.exe
windows7-x64
10сентя...ba.exe
windows10-2004-x64
10сентя...bd.exe
windows7-x64
7сентя...bd.exe
windows10-2004-x64
7сентя...14.exe
windows7-x64
3сентя...14.exe
windows10-2004-x64
3сентя...04.exe
windows7-x64
10сентя...04.exe
windows10-2004-x64
10сентя...73.exe
windows7-x64
10сентя...73.exe
windows10-2004-x64
сентя...4b.exe
windows7-x64
1сентя...4b.exe
windows10-2004-x64
10сентя...ee.exe
windows7-x64
3сентя...ee.exe
windows10-2004-x64
7сентя...75.exe
windows7-x64
3сентя...75.exe
windows10-2004-x64
7сентя...53.exe
windows7-x64
10сентя...53.exe
windows10-2004-x64
сентя...fa.exe
windows7-x64
10сентя...fa.exe
windows10-2004-x64
10сентя...e3.exe
windows7-x64
10сентя...e3.exe
windows10-2004-x64
10сентя...3a.exe
windows7-x64
3сентя...3a.exe
windows10-2004-x64
3сентя...25.exe
windows7-x64
10сентя...25.exe
windows10-2004-x64
10Analysis
-
max time kernel
144s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 02:04
Static task
static1
Behavioral task
behavioral1
Sample
сентябрь 2023(570)/00053bf64ec3040b73c84979799768dba9a03c5f0d2f73512977c7030e29dd49.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
сентябрь 2023(570)/00053bf64ec3040b73c84979799768dba9a03c5f0d2f73512977c7030e29dd49.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
сентябрь 2023(570)/00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819df.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
сентябрь 2023(570)/00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819df.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
сентябрь 2023(570)/0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
сентябрь 2023(570)/0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
сентябрь 2023(570)/01e5ebc2c096d465800660a0ad6d62208a5b2b675e3700f3734fac225b1d38bd.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
сентябрь 2023(570)/01e5ebc2c096d465800660a0ad6d62208a5b2b675e3700f3734fac225b1d38bd.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
сентябрь 2023(570)/01fc4ee8bd9cd9c2ee70ccd486f4f3d1fdd42f40fffc6ab66e9f3973f2000e14.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
сентябрь 2023(570)/01fc4ee8bd9cd9c2ee70ccd486f4f3d1fdd42f40fffc6ab66e9f3973f2000e14.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
сентябрь 2023(570)/036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
сентябрь 2023(570)/036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
сентябрь 2023(570)/045cbc9ff518aa3bf58f568868c326af3ea7dea491e2543233885ecbaec30eee.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
сентябрь 2023(570)/045cbc9ff518aa3bf58f568868c326af3ea7dea491e2543233885ecbaec30eee.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
сентябрь 2023(570)/0651c1ebd22042c0f18964dcf445e7b4f350b2d7d01413040860a2187fdea5e3.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
сентябрь 2023(570)/0651c1ebd22042c0f18964dcf445e7b4f350b2d7d01413040860a2187fdea5e3.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
Resource
win10v2004-20231215-en
General
-
Target
сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe
-
Size
523KB
-
MD5
2ee45a8f29a2a9650ecf303ba28ddf87
-
SHA1
36fc7927deda663b5dea936f952e047a28ce1ed5
-
SHA256
07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a
-
SHA512
3be0aec6f0e7a13c69a81760ae1aaec7990416071087a4799f11ec9852ba475d80e6b5481b7f45f9f444747cec13160a5c015f2e6fb4dde0f79a8ad94333c046
-
SSDEEP
12288:QjVtZ5/eTpd/upd/E2PKhk246c4MrgrMU0OViUYQF2xRTSns:QjTZ5GsPKWTQMQViUY1Xss
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2152 4708 WerFault.exe 07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exepid process 4708 07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe 4708 07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exedescription pid process Token: SeDebugPrivilege 4708 07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 10922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4708 -ip 47081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4708-1-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/4708-0-0x00000000003A0000-0x000000000042A000-memory.dmpFilesize
552KB
-
memory/4708-3-0x0000000004DE0000-0x0000000004E4C000-memory.dmpFilesize
432KB
-
memory/4708-5-0x0000000004FC0000-0x0000000005052000-memory.dmpFilesize
584KB
-
memory/4708-7-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/4708-8-0x0000000004F20000-0x0000000004F4A000-memory.dmpFilesize
168KB
-
memory/4708-10-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-48-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-59-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/4708-58-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-56-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-54-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-60-0x0000000005B80000-0x0000000005C1C000-memory.dmpFilesize
624KB
-
memory/4708-52-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-50-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-46-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-44-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-42-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-40-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-38-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-61-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/4708-36-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-34-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-32-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-30-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-28-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-26-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-24-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-22-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-20-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-18-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-16-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-14-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-12-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-9-0x0000000004F20000-0x0000000004F43000-memory.dmpFilesize
140KB
-
memory/4708-6-0x0000000005060000-0x00000000053B4000-memory.dmpFilesize
3.3MB
-
memory/4708-4-0x00000000054D0000-0x0000000005A74000-memory.dmpFilesize
5.6MB
-
memory/4708-2-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB