444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe
Size 60KB
Sample240418-z4fftsfa94
SHA256 444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1
MD5 bb89f45099d6a74bf6de2e5b1557994b
SHA1 b1de770b0bea298bd0061368c689724d4b5cbd8d
SHA512 611517efb17aed3f4fa97317618a840dda6b8541738fc9437218b91511e92a64fd30355f596f5d0596b31c8e7e558b49a95b1a7bba7a4a646390280fb0a02db6
SSDEEP 768:P8kXsqXMRKbsc+nJUlez5eYEqT5yXsqJRU7ihG1gfFNsHWP4jBS:k07bszJUyeYEocJiu4gfFi2+A
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/1700-0-0x0000000000400000-0x0000000000410000-memory.dmp	UPX
behavioral2/memory/1700-4-0x0000000000400000-0x0000000000410000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1700-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/1700-4-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 4948	1700	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	4628	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	winver.exe
4628	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3524	Explorer.EXE
Token: SeCreatePagefilePrivilege	3524	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4628	winver.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1700	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3524	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 4948	1700	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	86
PID 1700 wrote to memory of 4948	1700	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	86
PID 1700 wrote to memory of 4948	1700	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	86
PID 1700 wrote to memory of 4948	1700	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	86
PID 1700 wrote to memory of 4948	1700	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	86
PID 1700 wrote to memory of 4948	1700	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	86
PID 4948 wrote to memory of 4628	4948	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	87
PID 4948 wrote to memory of 4628	4948	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	87
PID 4948 wrote to memory of 4628	4948	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	87
PID 4948 wrote to memory of 4628	4948	444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe	87
PID 4628 wrote to memory of 3524	4628	winver.exe	57
PID 4628 wrote to memory of 2664	4628	winver.exe	45

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2664

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3524
- C:\Users\Admin\AppData\Local\Temp\444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe
  "C:\Users\Admin\AppData\Local\Temp\444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe
    "C:\Users\Admin\AppData\Local\Temp\444844c317ee5683469a607e244d9322019802d880e6fc5a694831e874d3abc1.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 392
        5⤵
        Program crash
        
        PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4628 -ip 4628
1⤵
PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1700-4-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2664-16-0x0000000000100000-0x0000000000106000-memory.dmp

Download

memory/2664-15-0x0000000000100000-0x0000000000106000-memory.dmp

Download

memory/3524-19-0x00007FFBF6EC0000-0x00007FFBF6EC1000-memory.dmp

Download

memory/3524-5-0x0000000002D60000-0x0000000002D66000-memory.dmp

Download

memory/3524-10-0x00007FFBF6D2D000-0x00007FFBF6D2E000-memory.dmp

Download

memory/3524-7-0x0000000002D60000-0x0000000002D66000-memory.dmp

Download

memory/4628-11-0x0000000077142000-0x0000000077143000-memory.dmp

Download

memory/4628-6-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Download

memory/4628-12-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Download

memory/4628-9-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Download

memory/4628-18-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Download

memory/4948-8-0x0000000000540000-0x0000000000F40000-memory.dmp

Download

memory/4948-3-0x0000000000400000-0x0000000000405000-memory.dmp

Download