3b8519095c875fa53b588000549b6a1e2821cc0f16e8628c6e1f5753e1aad115

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe
Size

4.4MB
MD5

887974d84eeae88582a854f8099c5102
SHA1

7749c87cae74439628ef0d706477700dbd306d06
SHA256

a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488
SHA512

e6e48e0f6edc176dda1880b133e480e20b71c1c8295beccc22a1c8a6fde41b7ee0a8b5d8b24739d494ab053e7c9d43379481a567656e2d3000659ebe09707eee
SSDEEP

98304:pFK09T8gpBnq8c7zw9RbGNdj5dhdI3uvHF/XK:po0J8gt7bAdPIp

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2088	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2900	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	28
PID 2088 wrote to memory of 2668	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	29
PID 2088 wrote to memory of 2668	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	29
PID 2088 wrote to memory of 2668	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	29
PID 2088 wrote to memory of 2668	2088	a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe	29

C:\Users\Admin\AppData\Local\Temp\a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe
"C:\Users\Admin\AppData\Local\Temp\a12aa651589ac345f319501bda42488fc12d1b8f6daffa35680535bb99c37488.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 728
  2⤵
  - Program crash
  PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/2088-14-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-55-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-3-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-4-0x0000000005800000-0x0000000005992000-memory.dmp

Filesize
1.6MB

Download
memory/2088-0-0x0000000001310000-0x000000000177C000-memory.dmp

Filesize
4.4MB

Download
memory/2088-11-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-10-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-9-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-12-0x0000000000640000-0x0000000000650000-memory.dmp

Filesize
64KB

Download
memory/2088-13-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-15-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-54-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-2-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/2088-16-0x0000000005B20000-0x0000000005C20000-memory.dmp

Filesize
1024KB

Download
memory/2088-60-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-64-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-63-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-62-0x0000000005B20000-0x0000000005C20000-memory.dmp

Filesize
1024KB

Download
memory/2088-18-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-61-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-59-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-58-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-17-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-1-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/2088-56-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2088-57-0x0000000005650000-0x0000000005690000-memory.dmp

Filesize
256KB

Download
memory/2900-53-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-44-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-42-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-40-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-39-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-37-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-34-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-48-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-19-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-25-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2900-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-28-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-21-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download