Resubmissions
11/04/2024, 07:29
240411-jbfccsef621011/04/2024, 07:28
240411-jaw9gshg4y911/04/2024, 07:28
240411-jawmysef471011/04/2024, 07:28
240411-jawb7aef46811/04/2024, 07:28
240411-jav2esef45707/04/2024, 09:04
240407-k11v2ahh64707/04/2024, 09:04
240407-k1s57ahe5z1007/04/2024, 09:03
240407-k1d19she411007/04/2024, 09:03
240407-kz78qahe4v818/12/2023, 04:55
231218-fj6bzaadg510Analysis
- max time kernel
263s - max time network
267s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
11/04/2024, 07:28
General
- Target 6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
- Size 1.9MB
- Sample240411-jav2esef45
- SHA256 6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5
Malware Config
Signatures
- UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe"C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe"C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 207003⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-microdesc-consensus.tmp
cached-microdescs.new
memory/792-3-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-5-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-6-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-7-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-8-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-9-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-38-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-42-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-43-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-45-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-47-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-44-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-48-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-50-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-58-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-65-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-63-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-62-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-56-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-60-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-55-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-53-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-49-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-52-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-51-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-46-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-73-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-84-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-95-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-96-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-99-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-98-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-93-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-92-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-89-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-100-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-94-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-78-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-77-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-87-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-76-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-86-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-83-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-81-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-80-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-69-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-75-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-71-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-70-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-67-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-59-0x0000000000400000-0x0000000000848000-memory.dmp
memory/792-5514-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3616-1-0x00000000026F0000-0x00000000028AF000-memory.dmp
memory/3616-2-0x00000000028D0000-0x0000000002A87000-memory.dmp