Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2024 05:27

General

  • Target

    79642aa8ae971b5e655cc5e4b989c133.exe

  • Size

    22KB

  • MD5

    79642aa8ae971b5e655cc5e4b989c133

  • SHA1

    ee12fc5dfdf42658d713c11d095627e4f1b4670e

  • SHA256

    b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144

  • SHA512

    cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4

  • SSDEEP

    384:cGIm/vdaWQ5UJ3vU8AZcWh36/2PA3fYQoy07uSFj2X/P57x:cGjQ5m3cz30OAvYQonuSJq3t

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79642aa8ae971b5e655cc5e4b989c133.exe
    "C:\Users\Admin\AppData\Local\Temp\79642aa8ae971b5e655cc5e4b989c133.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4956
    • \??\c:\users\admin\appdata\local\temp\79642aa8ae971b5e655cc5e4b989c133.exe
      c:\users\admin\appdata\local\temp\79642aa8ae971b5e655cc5e4b989c133.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Sets service image path in registry
        • Deletes itself
        PID:3320
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 340
          4⤵
          • Program crash
          PID:3308
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3320 -ip 3320
    1⤵
      PID:3496

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\windows\SysWOW64\mssrv32.exe
      Filesize

      22KB

      MD5

      79642aa8ae971b5e655cc5e4b989c133

      SHA1

      ee12fc5dfdf42658d713c11d095627e4f1b4670e

      SHA256

      b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144

      SHA512

      cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4

    • memory/452-3-0x0000000015110000-0x000000001511A000-memory.dmp
      Filesize

      40KB

    • memory/3320-2-0x0000000015110000-0x000000001511A000-memory.dmp
      Filesize

      40KB

    • memory/3320-6-0x0000000015110000-0x000000001511A000-memory.dmp
      Filesize

      40KB

    • memory/4956-0-0x0000000015110000-0x000000001511A000-memory.dmp
      Filesize

      40KB

    • memory/4956-4-0x0000000015110000-0x000000001511A000-memory.dmp
      Filesize

      40KB