Analysis

  • max time kernel
    143s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 23:34

General

  • Target

    7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe

  • Size

    225KB

  • MD5

    b1c3cf250437991bc52e7046251dc7bc

  • SHA1

    6321a7b20ab661ca6e2ad766d78db41919ea0fa7

  • SHA256

    7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421

  • SHA512

    abac0e590ba1bac3ce9531c30aaf3a8552e33fffa462d05e754c01949d4290aa51be0248c3069b451f1e752e8486c7b3cfc37622da06271e0dd430dcb9a11ada

  • SSDEEP

    6144:BA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:BATuTAnKGwUAW3ycQqgf

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2684
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe
        "C:\Users\Admin\AppData\Local\Temp\7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2812
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 300
            4⤵
            • Program crash
            PID:2356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 856
          3⤵
          • Program crash
          PID:1208
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:8
      1⤵
        PID:956
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
        1⤵
        • Modifies data under HKEY_USERS
        PID:4100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2812 -ip 2812
        1⤵
          PID:988
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2284 -ip 2284
          1⤵
            PID:3564

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2284-1-0x0000000004700000-0x0000000004D58000-memory.dmp
            Filesize

            6.3MB

          • memory/2284-2-0x0000000003D90000-0x0000000003D91000-memory.dmp
            Filesize

            4KB

          • memory/2284-6-0x0000000000400000-0x000000000043C000-memory.dmp
            Filesize

            240KB

          • memory/2284-12-0x0000000005910000-0x0000000006310000-memory.dmp
            Filesize

            10.0MB

          • memory/2284-15-0x0000000005910000-0x0000000006310000-memory.dmp
            Filesize

            10.0MB

          • memory/2284-18-0x0000000004700000-0x0000000004D58000-memory.dmp
            Filesize

            6.3MB

          • memory/2684-13-0x0000000000AC0000-0x0000000000AC6000-memory.dmp
            Filesize

            24KB

          • memory/2684-19-0x0000000000AC0000-0x0000000000AC6000-memory.dmp
            Filesize

            24KB

          • memory/3504-4-0x0000000000600000-0x0000000000606000-memory.dmp
            Filesize

            24KB

          • memory/3504-5-0x0000000000600000-0x0000000000606000-memory.dmp
            Filesize

            24KB

          • memory/3504-11-0x0000000000640000-0x0000000000646000-memory.dmp
            Filesize

            24KB