e13c0f9b20ac39ee663843af86145050cbfef47387088bb6fffa9c3955bf7c10

Analysis

max time kernel
45s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

recoverit_setup_full4153.exe
Size

2.0MB
MD5

d620ce87694d6aaf4851ea0b203b03a0
SHA1

e33d49f83dd531bfd0f8a595526c29e84950247f
SHA256

e13c0f9b20ac39ee663843af86145050cbfef47387088bb6fffa9c3955bf7c10
SHA512

831f6b0b3c2e675efc4dc3bafb63bcaf3f307e80eb77e4daa77deab31504187154514691814e6c13f5e87d8db225ee15e776c8c1d03f64adcc62fb91ff52d942
SSDEEP

49152:k05czfx+MZ5oqTGOFDyhFufVjyFT/28N9L7jE8usH:kIczfX6mjFtfV/8NNd

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

NFWCHK.exe

pid process

2312 NFWCHK.exe

pid	process
2312	NFWCHK.exe

Modifies Control Panel 1 IoCs

evasion

Processes:

recoverit_setup_full4153.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\MuiCached	recoverit_setup_full4153.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

recoverit_setup_full4153.exe

pid process

1624 recoverit_setup_full4153.exe
1624 recoverit_setup_full4153.exe

pid	process
1624	recoverit_setup_full4153.exe
1624	recoverit_setup_full4153.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

recoverit_setup_full4153.exe

description	pid	process	target process
PID 1624 wrote to memory of 2312	1624	recoverit_setup_full4153.exe	NFWCHK.exe
PID 1624 wrote to memory of 2312	1624	recoverit_setup_full4153.exe	NFWCHK.exe

C:\Users\Admin\AppData\Local\Temp\recoverit_setup_full4153.exe
"C:\Users\Admin\AppData\Local\Temp\recoverit_setup_full4153.exe"
1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  2⤵
  - Executes dropped EXE
  PID:2312

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\fdf62059e198439cb643fa2760254479 /t 2872 /p 1624
1⤵
PID:2948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
824B

MD5
acf9d6c4c320c5edb16e119e6430a55c

SHA1
c36d2bcf29ef471e2113353abdd72a93e7461757

SHA256
16c3ca3df403efa6cdf44a4264e8aaec01f58e29c33861ec70a53e60f3baffec

SHA512
fbfcd9e6ce2c6b95cf1debec0b07abbce0145ddc16f718b2a20355a276afeac066c4015c954bc7ac4e72997526b40fad327eb1aa0f3fd96865e3cf9447d1b0b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
1KB

MD5
e0aa6fd1a92a616090de396cb2bca71b

SHA1
24b8e43b2c08240a892d61806831723b7d6a7141

SHA256
a3ba3689452cff1c05755e2608e31a8d9ac040f0882570b5e9330afbb4d9d06c

SHA512
23ac80c1cc69947562cf0205512b0e55cdc9f040edb7adb9f46c66fd8c831fbe242678e97cd32119a252fed59ad5d4a18b7da1e71816041de417730562b2ba8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
1KB

MD5
dc78a8fea9c4ba9afae083adc245f49f

SHA1
f37c9b7f161fc8450b7cc088891e08e3cfd10071

SHA256
31b5e7b350e8c620b37a19c6cfa0d86664a38f1d2bd4a548d1016b26a06b259f

SHA512
35c9d38a488c89de5486a1b9cd8e59ce2e8060f855b5b649751ba5d18c8e679bfc7dca5284a5c5d6e4fb18d5e72f02348733d47e645e0acdabf3877288ad8d69

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
7KB

MD5
599aa358e45af451e87a631e72d4f8b5

SHA1
b3ba08e0920caaccab0ca507fc2f161584ab2df2

SHA256
b93d40403f2ff79793234b515317ee44e71ffe02d169c42fe44ab9451a327dcf

SHA512
28ba5b0c9cf8a161e8f00c9cebeced88631b4a7ea7229b4c9c8853ab9c115af2a1c3a7e441db96537822bf340e4172befedde2ebfe8478aa396c91735ccbb12c

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Filesize
223B

MD5
5babf2a106c883a8e216f768db99ad51

SHA1
f39e84a226dbf563ba983c6f352e68d561523c8e

SHA256
9e676a617eb0d0535ac05a67c0ae0c0e12d4e998ab55ac786a031bfc25e28300

SHA512
d4596b0aafe03673083eef12f01413b139940269255d10256cf535853225348752499325a5def803fa1189e639f4a2966a0fbb18e32fe8d27e11c81c9e19a0bb

Download Submit
memory/2312-1151-0x00000000016D0000-0x00000000016F4000-memory.dmp

Filesize
144KB

Download
memory/2312-1152-0x0000000001720000-0x0000000001738000-memory.dmp

Filesize
96KB

Download
memory/2312-1153-0x00007FFE7B230000-0x00007FFE7BBD1000-memory.dmp

Filesize
9.6MB

Download
memory/2312-1154-0x00000000018A0000-0x00000000018B0000-memory.dmp

Filesize
64KB

Download
memory/2312-1155-0x0000000001760000-0x0000000001780000-memory.dmp

Filesize
128KB

Download
memory/2312-1156-0x00007FFE7B230000-0x00007FFE7BBD1000-memory.dmp

Filesize
9.6MB

Download
memory/2312-1157-0x000000001BDB0000-0x000000001C0BE000-memory.dmp

Filesize
3.1MB

Download
memory/2312-1158-0x000000001C520000-0x000000001C569000-memory.dmp

Filesize
292KB

Download
memory/2312-1159-0x000000001C5E0000-0x000000001C642000-memory.dmp

Filesize
392KB

Download
memory/2312-1161-0x000000001D090000-0x000000001D12C000-memory.dmp

Filesize
624KB

Download
memory/2312-1160-0x000000001CB20000-0x000000001CFEE000-memory.dmp

Filesize
4.8MB

Download
memory/2312-1162-0x00000000019D0000-0x00000000019D8000-memory.dmp

Filesize
32KB

Download
memory/2312-1163-0x000000001D560000-0x000000001D59E000-memory.dmp

Filesize
248KB

Download
memory/2312-1165-0x00007FFE7B230000-0x00007FFE7BBD1000-memory.dmp

Filesize
9.6MB

Download