Analysis
- max time kernel
141s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
01/02/2024, 08:28
General
- Target 09062d02628640f8ce97ae0d57b17f4e.exe
- Size 751KB
- Sample240201-kc16wshean
- SHA256 dba609c16956e66f70b4476c2b9f009a6b37ad62b75cd7b570a049047fa7ca9b
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09062d02628640f8ce97ae0d57b17f4e.exe"C:\Users\Admin\AppData\Local\Temp\09062d02628640f8ce97ae0d57b17f4e.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 10042⤵
- Program crash
-
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2772 -ip 27721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SmartClock.exe
SmartClock.exe
memory/2772-2-0x00000000022B0000-0x0000000002341000-memory.dmp
memory/2772-3-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/2772-1-0x0000000000520000-0x0000000000620000-memory.dmp
memory/2772-15-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/3204-14-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/3204-13-0x0000000002120000-0x00000000021B1000-memory.dmp
memory/3204-12-0x0000000000640000-0x0000000000740000-memory.dmp
memory/3204-17-0x0000000000640000-0x0000000000740000-memory.dmp