Overview
overview
10Static
static
10153b116e6...66.vbs
windows7-x64
100153b116e6...66.vbs
windows10-2004-x64
108624e09793...a0.dll
windows7-x64
18624e09793...a0.dll
windows10-2004-x64
3d42ce863d0...be1.js
windows7-x64
1d42ce863d0...be1.js
windows10-2004-x64
1ed7b525ff2...7.xlsx
windows7-x64
1ed7b525ff2...7.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 02:18
Static task
static1
Behavioral task
behavioral1
Sample
0153b116e6a412cfd8dbf868de5cae3a8b3303c550eba80a0605ad4acfda6c66.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0153b116e6a412cfd8dbf868de5cae3a8b3303c550eba80a0605ad4acfda6c66.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
8624e09793361dd3a022021a93a17e3b755c256e0a10928b505257bb04f4d5a0.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
8624e09793361dd3a022021a93a17e3b755c256e0a10928b505257bb04f4d5a0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
d42ce863d02bc970b632e8f6794d433fe059670f1bcd42aaec99bac868d6ebe1.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
d42ce863d02bc970b632e8f6794d433fe059670f1bcd42aaec99bac868d6ebe1.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
ed7b525ff2b5d6c2a63878a1d7594b12025f3d7525898adb3c02cb958df09be7.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ed7b525ff2b5d6c2a63878a1d7594b12025f3d7525898adb3c02cb958df09be7.xlsx
Resource
win10v2004-20231215-en
General
-
Target
8624e09793361dd3a022021a93a17e3b755c256e0a10928b505257bb04f4d5a0.dll
-
Size
1.9MB
-
MD5
f0c2bcc63376572c1ee741505e8ac11b
-
SHA1
fefff0f17aaa8ab5905e43a1ff47db685776bfa6
-
SHA256
8624e09793361dd3a022021a93a17e3b755c256e0a10928b505257bb04f4d5a0
-
SHA512
56af36b2e62945de44a7b4625daea73978e04241135b2980c78a57cfe7c7b10683f609102d558ebd981f6599a531f74fa586f21472de09e5e16e863ecec0c280
-
SSDEEP
49152:GFRbq3P4BanfH1LkuvhgQd8dsXnDjHxKoZX9uNf5/gIHYtQTS30:Aq/4BanfJk2WQ2dsXnDTxSNR/gIHx
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1472 2940 WerFault.exe regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 736 wrote to memory of 2940 736 regsvr32.exe regsvr32.exe PID 736 wrote to memory of 2940 736 regsvr32.exe regsvr32.exe PID 736 wrote to memory of 2940 736 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8624e09793361dd3a022021a93a17e3b755c256e0a10928b505257bb04f4d5a0.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8624e09793361dd3a022021a93a17e3b755c256e0a10928b505257bb04f4d5a0.dll2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 6843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2940 -ip 29401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2940-0-0x00000000003D0000-0x00000000003D9000-memory.dmpFilesize
36KB