Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 01:49
Static task
static1
Behavioral task
behavioral1
Sample
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe
Resource
win10v2004-20240412-en
General
-
Target
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe
-
Size
987KB
-
MD5
a6455a248e43686bfda50622f2bd82d2
-
SHA1
de8544085d7969af9c9eda6cc418f26f9b144786
-
SHA256
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0
-
SHA512
2820d87ffb9b1088dd61da458e4891d8247a3185099fe195e8fb5d2f8a135607eaf013b43718e347c30f0095bfe581a9e6d0b160ccba86d35dec168ea638aa2e
-
SSDEEP
12288:00QxgjNKY/6sBjn+lkNp6MARWch8k6SFkJkgskKA0kZPiDsRyNX5UrLB/ccOTOKw:00Qxgj8Y3n+lQkg6kZPiARysLBOTO+FG
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exedescription pid process Token: SeDebugPrivilege 2248 a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exedescription pid process target process PID 2248 wrote to memory of 2768 2248 a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe WerFault.exe PID 2248 wrote to memory of 2768 2248 a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe WerFault.exe PID 2248 wrote to memory of 2768 2248 a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe"C:\Users\Admin\AppData\Local\Temp\a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2248 -s 5402⤵PID:2768
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2248-0-0x00000000001A0000-0x0000000000208000-memory.dmpFilesize
416KB
-
memory/2248-1-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmpFilesize
9.9MB
-
memory/2248-2-0x000000001B1B0000-0x000000001B230000-memory.dmpFilesize
512KB
-
memory/2248-3-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmpFilesize
9.9MB
-
memory/2248-4-0x000000001B1B0000-0x000000001B230000-memory.dmpFilesize
512KB