Overview

overview

8

Static

static

3

76fonpc.exe

windows7-x64

8

76fonpc.exe

windows10-2004-x64

Resubmissions

25-04-2024 12:39

240425-pv285aag93 8

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-04-2024 12:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    76fonpc.exe

  • Size

    1.3MB

  • MD5

    240fcb4aa34850b8f8b79fc92f1e2fef

  • SHA1

    76c6b8efc1601f5ae835864cd82874019fec11f8

  • SHA256

    5734abc72e2a80574600c73f98ddcb11d69f0bc28311d1d1b603cde277068fed

  • SHA512

    ab3e20857ab9fa75583c15f8a27e69cdf9328d2539fae3984c1202692db0ff93418c76fd9277c868b8d469770fe68ff574c8803f8061f87c7924d9459054e7f5

  • SSDEEP

    24576:yztTHTQ9VLfwGIICI4kdVPF6QZ8hKhzZc06WogeOf:yztr09VLfaI/ldVPQQZ8KFoR2

Score
8/10
persistence

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76fonpc.exe
    "C:\Users\Admin\AppData\Local\Temp\76fonpc.exe"
    1⤵
    • Sets service image path in registry
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1556 -s 112
      2⤵
        PID:2204

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1556-1-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

      Download