8cc02b721683f8b880c8d086ed055006dcf6155a6cd19435f74dd9296b74f5fc

Resubmissions

24/01/2024, 21:38

240124-1hatwshef5 5

24/01/2024, 21:31

240124-1cz7lahdf5 5

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe
Size

456KB
MD5

c6b57e042ceadb60d6fab217d3523e17
SHA1

d7c2599b2e7c68212b59c319440d27387a641650
SHA256

8cc02b721683f8b880c8d086ed055006dcf6155a6cd19435f74dd9296b74f5fc
SHA512

b73d655a49c07bf7cc6d75134a2bacf11bede80ab546ba86726def299303a7a66a516bfabd9f2d49fafee02d10bff09d0c55db25349397a80abd07680fcdaaa6
SSDEEP

6144:wEB03MbatmtkhU6f2eGpwxpUXZKIWGimc3KFHB5UNn/mRL6pXd0p9UcZY:T5atmEU6z2sgpWLsBuu1GgycO

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 2888	1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe	87
PID 2888 set thread context of 2356	2888	svchost.exe	88

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe
1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe
1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe
1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe
2888	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2888	1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe	87
PID 1320 wrote to memory of 2888	1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe	87
PID 1320 wrote to memory of 2888	1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe	87
PID 1320 wrote to memory of 2888	1320	malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe	87
PID 2888 wrote to memory of 2356	2888	svchost.exe	88
PID 2888 wrote to memory of 2356	2888	svchost.exe	88
PID 2888 wrote to memory of 2356	2888	svchost.exe	88
PID 2888 wrote to memory of 2356	2888	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe
"C:\Users\Admin\AppData\Local\Temp\malware_8CC02B721683F8B880C8D086ED055006DCF6155A6CD19435F74DD9296B74F5FC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:2356

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20240124-2133.dmp
1⤵
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-0-0x0000000003320000-0x0000000003324000-memory.dmp

Filesize
16KB

Download
memory/1320-4-0x0000000000090000-0x0000000000104000-memory.dmp

Filesize
464KB

Download
memory/1320-1-0x0000000000090000-0x0000000000104000-memory.dmp

Filesize
464KB

Download
memory/2356-15-0x0000000000C80000-0x0000000000CB7000-memory.dmp

Filesize
220KB

Download
memory/2356-84-0x0000000000C80000-0x0000000000CB7000-memory.dmp

Filesize
220KB

Download
memory/2356-19-0x0000000000C80000-0x0000000000CB7000-memory.dmp

Filesize
220KB

Download
memory/2356-17-0x0000000000C80000-0x0000000000CB7000-memory.dmp

Filesize
220KB

Download
memory/2356-12-0x0000000000C80000-0x0000000000CB7000-memory.dmp

Filesize
220KB

Download
memory/2888-8-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-21-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-6-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-7-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-10-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-20-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-3-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-18-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-11-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-13-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-32-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-33-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-43-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-55-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-52-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-62-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-72-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-83-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2888-5-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download