ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Submit
Reports

Overview

overview

Static

static

323389cde5...f3.exe

windows7-x64

323389cde5...f3.exe

windows10-2004-x64

365712147d...a7.exe

windows7-x64

365712147d...a7.exe

windows10-2004-x64

5474e75872...06.exe

windows7-x64

5474e75872...06.exe

windows10-2004-x64

out.exe

windows7-x64

out.exe

windows10-2004-x64

59c59ef90d...4d.exe

windows7-x64

59c59ef90d...4d.exe

windows10-2004-x64

63fb410fc5...22.exe

windows7-x64

63fb410fc5...22.exe

windows10-2004-x64

9443472de4...e5.exe

windows7-x64

9443472de4...e5.exe

windows10-2004-x64

97a877b999...8d.exe

windows7-x64

97a877b999...8d.exe

windows10-2004-x64

a0f5def5aa...93.exe

windows7-x64

a0f5def5aa...93.exe

windows10-2004-x64

abfe442282...b1.exe

windows7-x64

abfe442282...b1.exe

windows10-2004-x64

b21f34ecfa...73.exe

windows7-x64

b21f34ecfa...73.exe

windows10-2004-x64

b4b97aa67e...a9.zip

windows7-x64

b4b97aa67e...a9.zip

windows10-2004-x64

svchost.exe

windows7-x64

svchost.exe

windows10-2004-x64

b8ce017478...a8.exe

windows7-x64

b8ce017478...a8.exe

windows10-2004-x64

bbb4627895...f2.exe

windows7-x64

bbb4627895...f2.exe

windows10-2004-x64

bdf06acf03...63.exe

windows7-x64

bdf06acf03...63.exe

windows10-2004-x64

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
151s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 13:55

Sharing

Copy URL

Twitter E-mail

Static task

static1

8 signatures

Behavioral task

behavioral1

Sample

323389cde5a3059c6c6e5c6c711d11e434a577b11dc07a9aeb7f8e1fb661ecf3.exe

Resource

win7-20231215-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

323389cde5a3059c6c6e5c6c711d11e434a577b11dc07a9aeb7f8e1fb661ecf3.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Resource

win7-20231215-en

ransomware

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral4

Sample

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Resource

win10v2004-20231215-en

ransomware

windows10-2004-x64

14 signatures

150 seconds

Behavioral task

behavioral5

Sample

5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe

Resource

win7-20231215-en

persistence ransomware upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral6

Sample

5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe

Resource

win10v2004-20231215-en

ransomware upx

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral7

Sample

out.exe

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

out.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe

Resource

win7-20231215-en

ransomware

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral10

Sample

59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe

Resource

win10v2004-20231215-en

ransomware

windows10-2004-x64

14 signatures

150 seconds

Behavioral task

behavioral11

Sample

63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe

Resource

win7-20231215-en

persistence spyware stealer

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe

Resource

win10v2004-20231222-en

persistence spyware stealer

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

9443472de461e9e7a9d7b7d89fa13815521db1ecebea5054643664953ee366e5.exe

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

9443472de461e9e7a9d7b7d89fa13815521db1ecebea5054643664953ee366e5.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

97a877b999fb2a3c8286548ac4b20f364a862b132a87272fe273c670a654ba8d.exe

Resource

win7-20231215-en

evasion ransomware

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral16

Sample

97a877b999fb2a3c8286548ac4b20f364a862b132a87272fe273c670a654ba8d.exe

Resource

win10v2004-20231215-en

evasion ransomware

windows10-2004-x64

18 signatures

150 seconds

Behavioral task

behavioral17

Sample

a0f5def5aaaefa3ae538da9c643a5e381ea89cdee3e451ab1d0c52181d758593.exe

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

a0f5def5aaaefa3ae538da9c643a5e381ea89cdee3e451ab1d0c52181d758593.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

abfe4422828c6515e7b53c50a8f07dda0169f4ee34173357b6fa35b06fe144b1.exe

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

abfe4422828c6515e7b53c50a8f07dda0169f4ee34173357b6fa35b06fe144b1.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe

Resource

win7-20231215-en

persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral22

Sample

b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe

Resource

win10v2004-20231222-en

persistence ransomware

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral23

Sample

b4b97aa67e2fbfa344053be1c101cbd6560b0a5cfe2de8e2e637ba90c4df2ca9.zip

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

b4b97aa67e2fbfa344053be1c101cbd6560b0a5cfe2de8e2e637ba90c4df2ca9.zip

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

svchost.exe

Resource

win7-20231129-en

discovery evasion persistence ransomware

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral26

Sample

svchost.exe

Resource

win10v2004-20231215-en

discovery evasion persistence ransomware

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral27

Sample

b8ce0174783c9c7ec30f96f8857c356e61365562463457d3ef0d1f62f4d302a8.exe

Resource

win7-20231215-en

ransomware

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral28

Sample

b8ce0174783c9c7ec30f96f8857c356e61365562463457d3ef0d1f62f4d302a8.exe

Resource

win10v2004-20231215-en

ransomware

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral29

Sample

bbb46278959b4628106319457405a8cc04681c82c2c8afa30475d50ed63417f2.exe

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

bbb46278959b4628106319457405a8cc04681c82c2c8afa30475d50ed63417f2.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

bdf06acf03785275d01d4135b432b56b31c7f352f9be3cf8eca00286251aa163.exe

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

bdf06acf03785275d01d4135b432b56b31c7f352f9be3cf8eca00286251aa163.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

out.exe
Size

436KB
MD5

aec0dac2b75880cd43dcf189fde97e42
SHA1

3159ec24c4e766ee8af2dfeda0e9d87e64e08139
SHA256

975bb21e0b4941b1569e968ff02b8969d53ec3e090cb3a3ae28ad629cfe2453a
SHA512

4bf22c844e7df5f06adc2273872216ce57881df0affe4ebacd82c8e59b911575cfe00138615ef25e83062aa5da050c5a306c9c1fafc752444396d712c9831920
SSDEEP

6144:i4nt4N8qyv/j2+9cN9VNzmjhlPhdUiWing72gF/qXIWHsTfoaaYt+2ZOtFEmv0L:dt4K/i+89E9Wing72gFtWW+gOEmM

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3340	3692	WerFault.exe	90
4144	3692	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 3340	3692	out.exe	94
PID 3692 wrote to memory of 3340	3692	out.exe	94
PID 3692 wrote to memory of 3340	3692	out.exe	94

Processes

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 224
  2⤵
  - Program crash
  PID:3340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 224
  2⤵
  - Program crash
  PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3692 -ip 3692
1⤵
PID:3704

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads