Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-02-2024 00:34
Static task
static1
Behavioral task
behavioral1
Sample
HRH.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
HRH.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
HRH.exe
-
Size
1.4MB
-
MD5
e193dc737173afa9aef5fea6d589c757
-
SHA1
7b35f231bea70e08c7ddceb9ce341108181faabb
-
SHA256
328b07e33759c6666d7cce2f181430f3cfa53690bb3c3360dc314ac6bbd3700b
-
SHA512
0e5309511c4797dda5fdaa7af47041f51f9ff15097c73227210f353ff05c6955976d256aa482f742dabcfbb31e07a469cf83a0d92d4f2f42cf9fbfdf746e57d4
-
SSDEEP
24576:Y3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6d:rmYqHU7pHYY00VcCDdowG3tMa6d
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4812 set thread context of 5068 4812 HRH.exe 90 -
Program crash 1 IoCs
pid pid_target Process procid_target 1448 4812 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe 4812 HRH.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4812 HRH.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4812 wrote to memory of 5068 4812 HRH.exe 90 PID 4812 wrote to memory of 5068 4812 HRH.exe 90 PID 4812 wrote to memory of 5068 4812 HRH.exe 90 PID 4812 wrote to memory of 5068 4812 HRH.exe 90 PID 4812 wrote to memory of 5068 4812 HRH.exe 90 PID 4812 wrote to memory of 5068 4812 HRH.exe 90 PID 4812 wrote to memory of 5068 4812 HRH.exe 90 PID 4812 wrote to memory of 5068 4812 HRH.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\HRH.exe"C:\Users\Admin\AppData\Local\Temp\HRH.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵PID:5068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 4962⤵
- Program crash
PID:1448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4812 -ip 48121⤵PID:2612