Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:10
Static task
static1
Behavioral task
behavioral1
Sample
74f00c1ea7106568b0534c4026ebfcea.exe
Resource
win7-20231215-en
General
-
Target
74f00c1ea7106568b0534c4026ebfcea.exe
-
Size
919KB
-
MD5
74f00c1ea7106568b0534c4026ebfcea
-
SHA1
e248f79068f8bd37e302199a201f1919d69a69d8
-
SHA256
acef1b5caa40f98c38929cb8aeba895455ab7dd3e6c5522776128c29ecaf991a
-
SHA512
f643fb2295d0c8d6df78aa9d92cf30fa5d4360d3ee3a54e3baa0bf2b1c328533d221e219d99fd35cebfef2f9f1178f068b64331764a1d46ce6a914b5dd967882
-
SSDEEP
24576:O2chXEgYJoRNNTQQ1ldiVTzqiCZ+8Pg5Bh:O2c4onl5epzqiCRPg5Bh
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
74f00c1ea7106568b0534c4026ebfcea.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 74f00c1ea7106568b0534c4026ebfcea.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 74f00c1ea7106568b0534c4026ebfcea.exe -
Processes:
resource yara_rule behavioral2/memory/4396-2-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral2/memory/4396-4-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral2/memory/4396-5-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral2/memory/4396-6-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral2/memory/4396-7-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral2/memory/4396-8-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral2/memory/4396-9-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral2/memory/4396-10-0x0000000000400000-0x00000000004F2000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
74f00c1ea7106568b0534c4026ebfcea.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 74f00c1ea7106568b0534c4026ebfcea.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 74f00c1ea7106568b0534c4026ebfcea.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
74f00c1ea7106568b0534c4026ebfcea.exedescription pid process target process PID 3124 set thread context of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3968 4396 WerFault.exe 74f00c1ea7106568b0534c4026ebfcea.exe 916 4396 WerFault.exe 74f00c1ea7106568b0534c4026ebfcea.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
74f00c1ea7106568b0534c4026ebfcea.exepid process 4396 74f00c1ea7106568b0534c4026ebfcea.exe 4396 74f00c1ea7106568b0534c4026ebfcea.exe 4396 74f00c1ea7106568b0534c4026ebfcea.exe 4396 74f00c1ea7106568b0534c4026ebfcea.exe 4396 74f00c1ea7106568b0534c4026ebfcea.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
74f00c1ea7106568b0534c4026ebfcea.exedescription pid process target process PID 3124 wrote to memory of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe PID 3124 wrote to memory of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe PID 3124 wrote to memory of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe PID 3124 wrote to memory of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe PID 3124 wrote to memory of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe PID 3124 wrote to memory of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe PID 3124 wrote to memory of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe PID 3124 wrote to memory of 4396 3124 74f00c1ea7106568b0534c4026ebfcea.exe 74f00c1ea7106568b0534c4026ebfcea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f00c1ea7106568b0534c4026ebfcea.exe"C:\Users\Admin\AppData\Local\Temp\74f00c1ea7106568b0534c4026ebfcea.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\74f00c1ea7106568b0534c4026ebfcea.exe"C:\Users\Admin\AppData\Local\Temp\74f00c1ea7106568b0534c4026ebfcea.exe" Track="0001001000"2⤵
- Suspicious use of SetWindowsHookEx
PID:4396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 20203⤵
- Program crash
PID:3968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 20683⤵
- Program crash
PID:916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4396 -ip 43961⤵PID:4804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4396 -ip 43961⤵PID:3944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3124-0-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/4396-2-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/4396-4-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/4396-5-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/4396-6-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/4396-7-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/4396-8-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/4396-9-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/4396-10-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB