66e9fd31654348b954115a7e1ce9848282f4140c9bbe8c68f4413b629a5f9221

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4d94314d99bd3106cc0f1f5586eeaa90.exe
Size

680KB
MD5

4d94314d99bd3106cc0f1f5586eeaa90
SHA1

eaa204f314c183e057dc93607d09c9cd13dacce9
SHA256

66e9fd31654348b954115a7e1ce9848282f4140c9bbe8c68f4413b629a5f9221
SHA512

3279b34384e82af74e53ea2ece06d73fbf39313fb22ad3d0d4c43461e1e8580363b096e8366a39af7be6d44fcf31846bd3fc811b94cf2e2b1c113a755209a073
SSDEEP

12288:d3DAAw0jmgI7E8Gq2VvhxNOMfg33sUKpfcsFmcyouqa3wTQipF:d3DXw0agI7EjVvHXg33OpfPFmcyouqaa

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1572-0-0x0000000000400000-0x00000000005B6000-memory.dmp	upx
behavioral2/memory/1572-61-0x0000000000400000-0x00000000005B6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5080	1572	WerFault.exe	87

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	4d94314d99bd3106cc0f1f5586eeaa90.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	4d94314d99bd3106cc0f1f5586eeaa90.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1572	4d94314d99bd3106cc0f1f5586eeaa90.exe
1572	4d94314d99bd3106cc0f1f5586eeaa90.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1572	4d94314d99bd3106cc0f1f5586eeaa90.exe
1572	4d94314d99bd3106cc0f1f5586eeaa90.exe

C:\Users\Admin\AppData\Local\Temp\4d94314d99bd3106cc0f1f5586eeaa90.exe
"C:\Users\Admin\AppData\Local\Temp\4d94314d99bd3106cc0f1f5586eeaa90.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 2560
  2⤵
  - Program crash
  PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1572 -ip 1572
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html

Filesize
10KB

MD5
db3c0daa449e49932ea6e5844b4f4917

SHA1
8bfa74a5c02e00cde22dee57817f3b047a68e6fa

SHA256
9d9f46dcc0bdf59b729091c73b30025fd79f03d109fbcbde6adef474ab6f6b6e

SHA512
3aa4edf1bc4867007259d733b343c6e0f4afaa85501ed2c154d92075fca8b76607be611403723f90526d2d2c9d94771aee4b4583dc77508233f2145cc0b12272

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js

Filesize
202KB

MD5
a4fdd77e182bd2fabe300a47b5617a35

SHA1
e002b335c75b5edefcd251962f61f53a2ab8e0f2

SHA256
8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b

SHA512
ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js

Filesize
89KB

MD5
219073097031d9c1a95a1291d66f3a10

SHA1
2b7996b01d90b7f424f2a2e6063947461db4b2b2

SHA256
232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef

SHA512
9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5

Download Submit
memory/1572-0-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download
memory/1572-1-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/1572-61-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download