Analysis
-
max time kernel
143s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 04:15
Static task
static1
Behavioral task
behavioral1
Sample
4a69903d22bf91f398781b4c9ec374c2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a69903d22bf91f398781b4c9ec374c2.exe
Resource
win10v2004-20231215-en
General
-
Target
4a69903d22bf91f398781b4c9ec374c2.exe
-
Size
753KB
-
MD5
4a69903d22bf91f398781b4c9ec374c2
-
SHA1
165179e2a76184ded2bfcb398e3a31b73e3533ec
-
SHA256
61c588dbf3f007a23ddf6a686c20e44f452aa593f3ff9848be8be66801c6e227
-
SHA512
eddce9adc51512cb923367c0ef5b9dd397f1317f9dc1d9ba60716d8b8a348ec1833586f64c459a0de71ab57f311aabd8dce223819f6499f03f09ed9e5f7c464e
-
SSDEEP
12288:l5edwUnwkK53W2X60wrIo+yR7/gANtj5axxaFeKszs2GM+EkqNWGQb3s+wz:l5hwwkK5n6tMERTftj5axxaF/sI2aPku
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1980 dsffsd -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\dsffsd 4a69903d22bf91f398781b4c9ec374c2.exe File opened for modification C:\Windows\dsffsd 4a69903d22bf91f398781b4c9ec374c2.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2628 2448 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2448 4a69903d22bf91f398781b4c9ec374c2.exe Token: SeDebugPrivilege 1980 dsffsd -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1980 dsffsd -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1980 wrote to memory of 2788 1980 dsffsd 29 PID 1980 wrote to memory of 2788 1980 dsffsd 29 PID 1980 wrote to memory of 2788 1980 dsffsd 29 PID 1980 wrote to memory of 2788 1980 dsffsd 29 PID 2448 wrote to memory of 2628 2448 4a69903d22bf91f398781b4c9ec374c2.exe 30 PID 2448 wrote to memory of 2628 2448 4a69903d22bf91f398781b4c9ec374c2.exe 30 PID 2448 wrote to memory of 2628 2448 4a69903d22bf91f398781b4c9ec374c2.exe 30 PID 2448 wrote to memory of 2628 2448 4a69903d22bf91f398781b4c9ec374c2.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a69903d22bf91f398781b4c9ec374c2.exe"C:\Users\Admin\AppData\Local\Temp\4a69903d22bf91f398781b4c9ec374c2.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 3562⤵
- Program crash
PID:2628
-
-
C:\Windows\dsffsdC:\Windows\dsffsd1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Program Files\Internet Explorer\iExPlOrE.ExE"C:\Program Files\Internet Explorer\iExPlOrE.ExE"2⤵PID:2788
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753KB
MD54a69903d22bf91f398781b4c9ec374c2
SHA1165179e2a76184ded2bfcb398e3a31b73e3533ec
SHA25661c588dbf3f007a23ddf6a686c20e44f452aa593f3ff9848be8be66801c6e227
SHA512eddce9adc51512cb923367c0ef5b9dd397f1317f9dc1d9ba60716d8b8a348ec1833586f64c459a0de71ab57f311aabd8dce223819f6499f03f09ed9e5f7c464e