Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 22:34
Static task
static1
Behavioral task
behavioral1
Sample
64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe
Resource
win10v2004-20240508-en
General
-
Target
64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe
-
Size
822KB
-
MD5
e3b7b954d5742d1ae7381964a9fb78a8
-
SHA1
59d3311ea8be55d5eb4c29a849668ee0e48645e1
-
SHA256
64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62
-
SHA512
3d28ded2cdf8aa55c65d3c0d277a78bfd1666a3425615676d972015d1f26dbee676f7c73aea15743f42aad1e2a3a748d17d11f8adc892b4590a779b989b73503
-
SSDEEP
12288:kLP3rLTY5SYBzoXryJxsYXWCXqiBvIN12caVDh:kLkUY9oXC3XVXqiBWoV
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1784 2748 WerFault.exe 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exepid process 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe 2748 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe"C:\Users\Admin\AppData\Local\Temp\64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 10842⤵
- Program crash
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2748 -ip 27481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2748-0-0x000000007464E000-0x000000007464F000-memory.dmpFilesize
4KB
-
memory/2748-1-0x00000000006C0000-0x0000000000794000-memory.dmpFilesize
848KB
-
memory/2748-2-0x0000000005760000-0x0000000005D04000-memory.dmpFilesize
5.6MB
-
memory/2748-3-0x00000000051B0000-0x0000000005242000-memory.dmpFilesize
584KB
-
memory/2748-4-0x00000000056B0000-0x000000000574C000-memory.dmpFilesize
624KB
-
memory/2748-5-0x00000000062C0000-0x0000000006326000-memory.dmpFilesize
408KB
-
memory/2748-6-0x0000000005750000-0x000000000575A000-memory.dmpFilesize
40KB
-
memory/2748-7-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2748-8-0x00000000056A0000-0x00000000056AE000-memory.dmpFilesize
56KB
-
memory/2748-9-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB