Analysis
-
max time kernel
145s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03/01/2024, 13:37
General
-
Target
3eab7a22cef50ebc85d90d3fdf2e8ead.exe
-
Size
746KB
-
MD5
3eab7a22cef50ebc85d90d3fdf2e8ead
-
SHA1
bf14a9127ae7bf6fcff4e9fbd0412702f1ba365b
-
SHA256
1e4bc66d1d7b3e962e8b6840e0181315455deb487a3afbd620a3e027f02615ac
-
SHA512
70e9ec68db1f66201e511127e9e3594c8bc02008fd294896366dd2a506da2f10198b48ab290667401440e6d6bf0f84fd84b7f24ec076d74d68e4cdea12b20d21
-
SSDEEP
12288:kvuJzqumavLunZ2zshEeJPyDw3W+PmYNaV+ium2lI7uT:OfPqRzlCPyDwvPmYNaHum2lIq
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3eab7a22cef50ebc85d90d3fdf2e8ead.exe"C:\Users\Admin\AppData\Local\Temp\3eab7a22cef50ebc85d90d3fdf2e8ead.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 2242⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4492 -ip 44921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 2161⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1204 -ip 12041⤵
-
C:\Windows\SysWOW64\help.comC:\Windows\SysWOW64\help.com1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
788KB