Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 01:18
Static task
static1
Behavioral task
behavioral1
Sample
37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe
Resource
win10v2004-20240419-en
General
-
Target
37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe
-
Size
619KB
-
MD5
ed1e2fd68e9de44ea4e01c7897f64411
-
SHA1
a42eb4e6084ac91d1fad3ef9fe01d8d3e9db0c26
-
SHA256
37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134
-
SHA512
6bef9338609c2d307ace1620d8e8c8a7d2888448b04a259dbd54937aa92255f8805c696558177303e95ebcf74d041d995b392e6084a92f80789d7422d02f7bf1
-
SSDEEP
12288:gYIPXjyEcoqe8OKZDOZqB8tMX4tVOiaatVSSDc1ow1rxEdex:gYIPuEtq/KoDX4XaaaSo1DUd
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2648 2972 WerFault.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exepowershell.exepid process 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 2596 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exepowershell.exedescription pid process Token: SeDebugPrivilege 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe Token: SeDebugPrivilege 2596 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exedescription pid process target process PID 2972 wrote to memory of 2596 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe powershell.exe PID 2972 wrote to memory of 2596 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe powershell.exe PID 2972 wrote to memory of 2596 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe powershell.exe PID 2972 wrote to memory of 2596 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe powershell.exe PID 2972 wrote to memory of 2572 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2572 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2572 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2572 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2528 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2528 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2528 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2528 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2736 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2736 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2736 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2736 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2512 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2512 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2512 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2512 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2920 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2920 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2920 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2920 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe PID 2972 wrote to memory of 2648 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe WerFault.exe PID 2972 wrote to memory of 2648 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe WerFault.exe PID 2972 wrote to memory of 2648 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe WerFault.exe PID 2972 wrote to memory of 2648 2972 37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"2⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"2⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"2⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"2⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"C:\Users\Admin\AppData\Local\Temp\37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134.exe"2⤵PID:2920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 9282⤵
- Program crash
PID:2648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2972-0-0x00000000003D0000-0x0000000000472000-memory.dmpFilesize
648KB
-
memory/2972-1-0x0000000074960000-0x000000007504E000-memory.dmpFilesize
6.9MB
-
memory/2972-2-0x00000000041A0000-0x00000000041E0000-memory.dmpFilesize
256KB
-
memory/2972-3-0x00000000003B0000-0x00000000003D0000-memory.dmpFilesize
128KB
-
memory/2972-4-0x0000000000790000-0x00000000007A4000-memory.dmpFilesize
80KB
-
memory/2972-5-0x000000000A180000-0x000000000A1F2000-memory.dmpFilesize
456KB
-
memory/2972-8-0x0000000074960000-0x000000007504E000-memory.dmpFilesize
6.9MB
-
memory/2972-9-0x00000000041A0000-0x00000000041E0000-memory.dmpFilesize
256KB