cb6c3866cd7f41f57b5a814f61f5caf271dabf1b7112a5e647c3fdb5785ec537 | Triage

Analysis

max time kernel
141s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

797f3beb3942082bbf9363e75d08819e.exe
Size

1.1MB
MD5

797f3beb3942082bbf9363e75d08819e
SHA1

199425d7e38a1729d94df69dc916d5792b30e987
SHA256

cb6c3866cd7f41f57b5a814f61f5caf271dabf1b7112a5e647c3fdb5785ec537
SHA512

4f863a9772f464a0a25579d0dcc50c774935133f710f474cb60a227a011378674008f588e5b80c67fe8210b10e61909794244570857132ac91c7fcce6368eea0
SSDEEP

24576:Mpm2EGrjm3k2W+hvacdFIusL6mZtVRDPmK7bY:3IAkUhpdFUL6atVhT70

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	1040	WerFault.exe	84

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows32 = "C:\\Windows\\SysWow64\\Windows32.exe"	797f3beb3942082bbf9363e75d08819e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft\Windows\CurrentVersion\Run	797f3beb3942082bbf9363e75d08819e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	797f3beb3942082bbf9363e75d08819e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft	797f3beb3942082bbf9363e75d08819e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows	797f3beb3942082bbf9363e75d08819e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	797f3beb3942082bbf9363e75d08819e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	797f3beb3942082bbf9363e75d08819e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1040	797f3beb3942082bbf9363e75d08819e.exe
1040	797f3beb3942082bbf9363e75d08819e.exe
1040	797f3beb3942082bbf9363e75d08819e.exe
1040	797f3beb3942082bbf9363e75d08819e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1040	797f3beb3942082bbf9363e75d08819e.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	797f3beb3942082bbf9363e75d08819e.exe

C:\Users\Admin\AppData\Local\Temp\797f3beb3942082bbf9363e75d08819e.exe
"C:\Users\Admin\AppData\Local\Temp\797f3beb3942082bbf9363e75d08819e.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 220
  2⤵
  - Program crash
  PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1040 -ip 1040
1⤵
PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-0-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/1040-1-0x0000000000400000-0x0000000000B01000-memory.dmp

Filesize
7.0MB

Download