dd955a271bbbfab55626c30f4a6e75205ed2018a342109bfaf7a744e135e2912

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbd96b1a1421f61d644ac48ccfe6edc5.exe
Size

704KB
MD5

bbd96b1a1421f61d644ac48ccfe6edc5
SHA1

3842cc6ff6d64bfe16a2256fb651286d4e5430e7
SHA256

dd955a271bbbfab55626c30f4a6e75205ed2018a342109bfaf7a744e135e2912
SHA512

45c56da8714eebb8c8a5bdea13d862db0ec12ae1e28ae9dbcf9ab5904da8ac11bebf82bf182c5f373673572b0c5fbc8f463a429a4ed97495500512634fb103b1
SSDEEP

12288:r88ZOYDB2enPyfmYXWXP+V/tv27bRVUMwA6+p2y8t+hO0cknVTNO2+Kn3P:l7DkckmBMu3EyCObOy

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2448	Hacker.com.cn.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	bbd96b1a1421f61d644ac48ccfe6edc5.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	bbd96b1a1421f61d644ac48ccfe6edc5.exe
File created	C:\Windows\UNINSTAL.BAT	bbd96b1a1421f61d644ac48ccfe6edc5.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3528	2528	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	bbd96b1a1421f61d644ac48ccfe6edc5.exe
Token: SeDebugPrivilege	2448	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1912	2448	Hacker.com.cn.exe	93
PID 2448 wrote to memory of 1912	2448	Hacker.com.cn.exe	93
PID 2528 wrote to memory of 4820	2528	bbd96b1a1421f61d644ac48ccfe6edc5.exe	96
PID 2528 wrote to memory of 4820	2528	bbd96b1a1421f61d644ac48ccfe6edc5.exe	96
PID 2528 wrote to memory of 4820	2528	bbd96b1a1421f61d644ac48ccfe6edc5.exe	96

C:\Users\Admin\AppData\Local\Temp\bbd96b1a1421f61d644ac48ccfe6edc5.exe
"C:\Users\Admin\AppData\Local\Temp\bbd96b1a1421f61d644ac48ccfe6edc5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 684
  2⤵
  - Program crash
  PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\UNINSTAL.BAT
  2⤵
  PID:4820

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2528 -ip 2528
1⤵
PID:744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Hacker.com.cn.exe

Filesize
704KB

MD5
bbd96b1a1421f61d644ac48ccfe6edc5

SHA1
3842cc6ff6d64bfe16a2256fb651286d4e5430e7

SHA256
dd955a271bbbfab55626c30f4a6e75205ed2018a342109bfaf7a744e135e2912

SHA512
45c56da8714eebb8c8a5bdea13d862db0ec12ae1e28ae9dbcf9ab5904da8ac11bebf82bf182c5f373673572b0c5fbc8f463a429a4ed97495500512634fb103b1

Download Submit
C:\Windows\Hacker.com.cn.exe

Filesize
256KB

MD5
8eb651e33cc60b28a3a0bc68d580a2cd

SHA1
c430b64cf4d72d9b28d8c8c25ef62c71f747eae1

SHA256
c321e0b3ebf03c9ab0df3b2f7e0ba58a8d9588934f7dbacb0950364039c8dc4e

SHA512
e43b28fbb9fa3449af75a5be6a2e0e7f6b723655d765d5dbfe509f4d4333ab08461960a8b71f3012976dd07820cdc080726e756f97a9003d2ee1f549699452b6

Download Submit
C:\Windows\UNINSTAL.BAT

Filesize
186B

MD5
b500fc0b48001ff4968cca8c728eea0a

SHA1
a83e7a5778351c3ba01bbd42eb3b5b2ee280b662

SHA256
38d5bafd337663f1b70c8f5c6491b274f0ba38590a711b720a18db27a8039cae

SHA512
2920617d15d7d4243e895cd60da752fe376b17e28813f701daf8058601780eb545241365baf0554aee0da96bc9e50ec18150f0f37876c005b8f768fce418c8e4

Download Submit
memory/2448-6-0x0000000000400000-0x00000000004C3200-memory.dmp

Filesize
780KB

Download
memory/2448-7-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/2448-12-0x0000000000400000-0x00000000004C3200-memory.dmp

Filesize
780KB

Download
memory/2448-13-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/2528-0-0x0000000000400000-0x00000000004C3200-memory.dmp

Filesize
780KB

Download
memory/2528-1-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2528-10-0x0000000000400000-0x00000000004C3200-memory.dmp

Filesize
780KB

Download