94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 01:40

Target

94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe
Size

1.4MB
MD5

78626f662b2669f5d5a19820b113d13b
SHA1

b4ab6d5cc05a5f951d5dea915abac8c85d99901f
SHA256

94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f
SHA512

a0c0d84d204fa75bc0f05d676c45330bafa4fd6baf1c3b9b5d511a813cd1d0059c58949b581e956ac436ac7b0d12130d63c5d86130db1e34f73bc5d1b73316ca
SSDEEP

24576:uF/6FjEIvAZwEG2FvGEOFsrwmPMo3lx9NcMI/5dXz1P:Y/6REAqwuOnmV3lRQB5z

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3156	3220	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe
3220	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe

C:\Users\Admin\AppData\Local\Temp\94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe
"C:\Users\Admin\AppData\Local\Temp\94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1924
  2⤵
  - Program crash
  PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3220 -ip 3220
1⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4516

memory/3220-0-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/3220-1-0x0000000000DF0000-0x0000000000F5C000-memory.dmp

Filesize
1.4MB

Download
memory/3220-2-0x0000000005E10000-0x00000000063B4000-memory.dmp

Filesize
5.6MB

Download
memory/3220-3-0x0000000005940000-0x00000000059D2000-memory.dmp

Filesize
584KB

Download
memory/3220-4-0x0000000005A80000-0x0000000005B1C000-memory.dmp

Filesize
624KB

Download
memory/3220-5-0x00000000063C0000-0x0000000006714000-memory.dmp

Filesize
3.3MB

Download
memory/3220-6-0x0000000005D10000-0x0000000005D20000-memory.dmp

Filesize
64KB

Download
memory/3220-7-0x0000000005A40000-0x0000000005A4A000-memory.dmp

Filesize
40KB

Download
memory/3220-8-0x0000000005D10000-0x0000000005D20000-memory.dmp

Filesize
64KB

Download
memory/3220-9-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download