Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 19:23

General

  • Target

    2396410e36864797e34181b94fba161f106f27a5128dc648d8564cf6c5834693.exe

  • Size

    213KB

  • MD5

    9ad79306a03519180ea892724d2dd16f

  • SHA1

    6796558c7b6f94a2416634239f60114097977b49

  • SHA256

    2396410e36864797e34181b94fba161f106f27a5128dc648d8564cf6c5834693

  • SHA512

    ac7b2e45aa3ffefeb55375466419ff08cac947f6290ae67bdc5058e6853be46eb91f547243106cfaaa6d49898dbd134c4d935981ab7c3d346a77fc005eaa9971

  • SSDEEP

    6144:ztvBPnU1b7e9SQii1EkoNlhlrQ2ZrM2xh:Zv1nWdQP1EDhZPxh

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2396410e36864797e34181b94fba161f106f27a5128dc648d8564cf6c5834693.exe
    "C:\Users\Admin\AppData\Local\Temp\2396410e36864797e34181b94fba161f106f27a5128dc648d8564cf6c5834693.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Program Files (x86)\Microsoft Build\Isass.exe
      "C:\Program Files (x86)\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1232
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1020
        3⤵
        • Program crash
        PID:2608
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1232 -ip 1232
    1⤵
      PID:1796

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Build\Isass.exe

      Filesize

      213KB

      MD5

      9ad79306a03519180ea892724d2dd16f

      SHA1

      6796558c7b6f94a2416634239f60114097977b49

      SHA256

      2396410e36864797e34181b94fba161f106f27a5128dc648d8564cf6c5834693

      SHA512

      ac7b2e45aa3ffefeb55375466419ff08cac947f6290ae67bdc5058e6853be46eb91f547243106cfaaa6d49898dbd134c4d935981ab7c3d346a77fc005eaa9971

    • C:\odt\office2016setup.exe

      Filesize

      5.3MB

      MD5

      9df77f7f13189d4b002c32ace44d96a0

      SHA1

      09d55f56ff2ca919696c8227f08cbb47400652ef

      SHA256

      5d12e9992dbab0e878278433fc9973cbd4522811faf44cfd04c9065535782e7e

      SHA512

      643c82f59b8dca88f03d641dc7d42541cfa0c3dabaacaacd1a423a43fc246cfa48eae332d3be8b10fa9f4977bafc8875da96e744b864b8ac63db02a9691fd18c

    • memory/1232-9-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/1232-7-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/1232-8-0x0000000001860000-0x0000000001861000-memory.dmp

      Filesize

      4KB

    • memory/1232-12-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/1232-13-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/1232-14-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/1232-16-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/1232-17-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/1232-26-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/4896-6-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/4896-0-0x0000000000400000-0x00000000016A7000-memory.dmp

      Filesize

      18.7MB

    • memory/4896-1-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

      Filesize

      4KB