Overview

overview

5

Static

static

3

nRi28Wtqb1.exe

windows10-2004-x64

Analysis

  • max time kernel
    21s
  • max time network
    23s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-03-2024 01:48

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    nRi28Wtqb1.exe

  • Size

    5.6MB

  • MD5

    872b0fa8c0306040f181d08c5d7a252b

  • SHA1

    a08cf74361c96aa4d7e4503af6563c63b95f1973

  • SHA256

    3a5576c4e7d9ed56cc295fea24ef0fa68cf4235dfefa434caa32015887e757c3

  • SHA512

    23d8610ac8bfcb68695b652dd8d35edcc5f17994c90966ef0cabf11489d983cc852dd8e6d36ec85c78ec6f63cb6a7b21238a6d9687494f3ef99bc7ca86a4a277

  • SSDEEP

    98304:GRx4heu/+/tswG+PJPigEtVTH41ZE6HqM/aZeOO4wZivrH/LXmfI1ZWQpy:GL4gy+/tbG+PJa3txT6KKaLbwZivrjdJ

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nRi28Wtqb1.exe
    "C:\Users\Admin\AppData\Local\Temp\nRi28Wtqb1.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\nRi28Wtqb1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\nRi28Wtqb1.exe" MD5
        3⤵
          PID:3860
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:3728
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:400
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c CLS
            2⤵
              PID:1080
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x4 /state0:0xa3959855 /state1:0x41c64e6d
            1⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:2900

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1392-0-0x00007FFEAAFD0000-0x00007FFEAAFD2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1392-1-0x00007FF78E6A0000-0x00007FF78F06D000-memory.dmp

            Filesize

            9.8MB

            Download

          • memory/1392-2-0x00007FF78E6A0000-0x00007FF78F06D000-memory.dmp

            Filesize

            9.8MB

            Download

          • memory/1392-6-0x00007FF78E6A0000-0x00007FF78F06D000-memory.dmp

            Filesize

            9.8MB

            Download