a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078.exe
Size

296KB
MD5

80aefa24f0742ce38c272092055bf476
SHA1

54182751e53ca03e8753374201ee8369e56ef127
SHA256

a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078
SHA512

4363e794cf3275551165f93df91c4ccb369174a9a3c3ca454b529bdc139bddc5fadc3eda11a43eec3ac11a09dc5bf38e598e1cef149b12f74dc37f811593fbc4
SSDEEP

6144:wM08zFTpntaU8/gRh4i7soCcvzep5iwdRtfMbEK8Vt5n:KITpntH8/gX4i4cqpTfL1t

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	3944	WerFault.exe	81

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3944	a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078.exe
3944	a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078.exe

C:\Users\Admin\AppData\Local\Temp\a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078.exe
"C:\Users\Admin\AppData\Local\Temp\a5a421422f1d396a96e5c9b9b7113883f06483853ab52c3d0027e80d24d55078.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1116
  2⤵
  - Program crash
  PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3944 -ip 3944
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3944-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3944-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3944-4-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download