Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 16:15
Behavioral task
behavioral1
Sample
b4ca17c0028b9e5d1618b4f0b30950a6a901b3904b5e40b9e766311c661a9089.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b4ca17c0028b9e5d1618b4f0b30950a6a901b3904b5e40b9e766311c661a9089.exe
Resource
win10v2004-20240412-en
General
-
Target
b4ca17c0028b9e5d1618b4f0b30950a6a901b3904b5e40b9e766311c661a9089.exe
-
Size
1.2MB
-
MD5
2243baab4fa593ac1444212612936771
-
SHA1
5d00a21b1ed291d7bf33ed3a312b7aa05ae7bae7
-
SHA256
b4ca17c0028b9e5d1618b4f0b30950a6a901b3904b5e40b9e766311c661a9089
-
SHA512
9aaf856dbf3fe35bb0f0f28cdfb7925608f71826e9537d8c674bc2d03651e96c4736bda98db613fa08d6ebf573c38dd0a3f3f3ca2014e3b3ba5d5294cf957093
-
SSDEEP
24576:sG8C4F3iQLomlee+kjUiwQLomlee+kjUi:MC4Fymlakjemlakj
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 884 2420 WerFault.exe b4ca17c0028b9e5d1618b4f0b30950a6a901b3904b5e40b9e766311c661a9089.exe 1752 2420 WerFault.exe b4ca17c0028b9e5d1618b4f0b30950a6a901b3904b5e40b9e766311c661a9089.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4ca17c0028b9e5d1618b4f0b30950a6a901b3904b5e40b9e766311c661a9089.exe"C:\Users\Admin\AppData\Local\Temp\b4ca17c0028b9e5d1618b4f0b30950a6a901b3904b5e40b9e766311c661a9089.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 5402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 5482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2420 -ip 24201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2420 -ip 24201⤵