Analysis

  • max time kernel
    138s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 21:14

General

  • Target

    b834bb9bb6fb21090ab1cf2e0f4fefb6.exe

  • Size

    29.0MB

  • MD5

    b834bb9bb6fb21090ab1cf2e0f4fefb6

  • SHA1

    9aa53305fca6db5493b724e5854d89d8ee346dbf

  • SHA256

    884df1caa180ebc43ad5c67f64272040ad914165bf8212b0bb5b95448b5be61d

  • SHA512

    21c1bc90547c9656ceef40e4ef428b01f4a99e07a6d56cf0b63e2a0b6a2d030e27c675f30af2bfa713cbcbd0d74f2b18211fd174de0d98f5cc85c1ef97b42ee2

  • SSDEEP

    196608:jUdkKzMzo1XU8d+8wSZ/gd2cBnvjeApaAvktrlrB3ytPqVxUQVmBDTSWhi:OMzo1XnI2cNvjtIAvkt0PqbsBDTs

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b834bb9bb6fb21090ab1cf2e0f4fefb6.exe
    "C:\Users\Admin\AppData\Local\Temp\b834bb9bb6fb21090ab1cf2e0f4fefb6.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:4948
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 488
      2⤵
      • Program crash
      PID:4552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4948 -ip 4948
    1⤵
      PID:4920

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7-zip.chm

      Filesize

      29.1MB

      MD5

      61d97ad58f7a9355349339a4af03284d

      SHA1

      baf90a9aa1434c770cc653dd42ea8f6ea70a039b

      SHA256

      d9a30698afd62b9104d56bfdd5bba17deaec24d05e481c201db7e8d6db77bc39

      SHA512

      6bb1be596bf60a2c03b0acf4f026bdbaa2e91a8f4f803b1c70d42083d55803c8b38b36fbc35b62afbc24a74164ac2da4f633e1492c721b90e5eaf41ca0441a91

    • C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll

      Filesize

      5B

      MD5

      b5b682b742431a52ea8b17c72ad9c572

      SHA1

      326320f469235708c59f678c9a7357dca552d306

      SHA256

      30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

      SHA512

      4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

    • memory/4948-0-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/4948-1306-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB