3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe
Size

863KB
MD5

ae4d18ea556b690302eac740792e2e55
SHA1

3187cc211bb49f7cbd88ecc03cdd29ffb2614c58
SHA256

3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe
SHA512

ca09347b22a3704d296236c0631888cecee0bef2a490abfa7f9e073f5a8db5301e084aab77f3767fbe7bc96dc48e9dbfc2e83ed3c20ef76acb991ecabf93e9a8
SSDEEP

24576:pRmJkcoQricOIQxiZY1iallVaKWBuzP6Ok:mJZoQrbTFZY1iallgKWWs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

60 4480 WerFault.exe 3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe

pid	pid_target	process	target process
60	4480	WerFault.exe	3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe

pid	process
4480	3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe
4480	3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe

pid	process
4480	3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe
4480	3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe

description	pid	process	target process
PID 4480 wrote to memory of 4744	4480	3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe	RegSvcs.exe
PID 4480 wrote to memory of 4744	4480	3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe	RegSvcs.exe
PID 4480 wrote to memory of 4744	4480	3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe
"C:\Users\Admin\AppData\Local\Temp\3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\3ae7a3261dea6122f2df7f37624ffa760449c8ed90ef58f056be1de0522580fe.exe"
2⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 752
2⤵
- Program crash
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4480 -ip 4480
1⤵
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4480-10-0x0000000004260000-0x0000000004264000-memory.dmp

Filesize
16KB

Download