4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe
Size

1.4MB
MD5

0e1b49bac5f1ad4e9c58f17be12f18cf
SHA1

c3946eb6ff80d2eb8cb7ede78bbc8e31e70e36b9
SHA256

4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941
SHA512

40a281519f67d1aa5020bd6625e434d9ac11deaaa1a2285a5dad0d1917a753e4f2655acd04ef21cd56a1bee173c2dca61e87cde8f59ce0ec82f0c7d40e68f2fd
SSDEEP

24576:E3mJ4QH5npAbbt89g6lkRcHc/7jVt6G+xJKr6AOALfrSUv15gmm7kqQILp52HTb/:E3Y59rlkRH/7CG+xJZAOALfrSUv15gmz

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lcjfugur = "C:\\Users\\Public\\Lcjfugur.url"	4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4412 3984 WerFault.exe 4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe

pid	pid_target	process	target process
4412	3984	WerFault.exe	4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	29	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	31	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe

pid	process
3984	4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe
3984	4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe
3984	4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe

description	pid	process	target process
PID 3984 wrote to memory of 620	3984	4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe	extrac32.exe
PID 3984 wrote to memory of 620	3984	4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe	extrac32.exe
PID 3984 wrote to memory of 620	3984	4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe	extrac32.exe

C:\Users\Admin\AppData\Local\Temp\4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe
"C:\Users\Admin\AppData\Local\Temp\4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\4a9a6b457748dc41738056ad44af098c3cc3c806ed1b756aaac7b589e5373941.exe C:\\Users\\Public\\Libraries\\Lcjfugur.PIF
2⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1740
2⤵
- Program crash
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2668,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3984 -ip 3984
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-0-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/3984-6-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3984-8-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/3984-9-0x000000003F990000-0x000000003FCDA000-memory.dmp

Filesize
3.3MB

Download