Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 05:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hajde-lavacrypt-dfgs.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
hajde-lavacrypt-dfgs.exe
-
Size
2.9MB
-
MD5
f561ee026ad652bed5d2dbca19b0f6da
-
SHA1
42a9d231a9c44331ac6f6327de9e3fa7d796c3d4
-
SHA256
c35d5fb22d47e276e38fde699fc3b1e88e60a708d85b6ebea69815dec5d4883e
-
SHA512
52de39805c40f30f2ab7aebd6f143cc1d5ecd6bb95b767a45d4c212f48ee16df6425309463d2cc8703dfa0cb796b42fafb75dfd7836f65ee09e13c9318c31e4e
-
SSDEEP
49152:GC5pOewgkXW0aOtXZpv8axPoPADdvcPru1221mduTjSuoqaesz+pgInL/rKUvYp:jjInXW0tXZaaxPoPkvR2kSu1phnL/rYp
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hajde-lavacrypt-dfgs.exedescription pid process Token: SeDebugPrivilege 1760 hajde-lavacrypt-dfgs.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
hajde-lavacrypt-dfgs.exedescription pid process target process PID 1760 wrote to memory of 2560 1760 hajde-lavacrypt-dfgs.exe WerFault.exe PID 1760 wrote to memory of 2560 1760 hajde-lavacrypt-dfgs.exe WerFault.exe PID 1760 wrote to memory of 2560 1760 hajde-lavacrypt-dfgs.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hajde-lavacrypt-dfgs.exe"C:\Users\Admin\AppData\Local\Temp\hajde-lavacrypt-dfgs.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1760 -s 5922⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1760-0-0x0000000000900000-0x0000000000908000-memory.dmpFilesize
32KB
-
memory/1760-1-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/1760-2-0x000000001B220000-0x000000001B2A0000-memory.dmpFilesize
512KB
-
memory/1760-3-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/1760-4-0x000000001B220000-0x000000001B2A0000-memory.dmpFilesize
512KB