15a6050dae94af879b4ef098091121126297612c3bd29e6e857cae2926f8326c

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Noua comanda de achizitie este atasata.exe
Size

1016KB
MD5

5091fc162ff9ad52daf47aa6b6131b85
SHA1

64604fd28c896f9eba105841d216d41f4d0001a1
SHA256

9302b88f499f05c0b9bc9ab0858c6fae4f1d7d45a648f5e292108b258d757f2a
SHA512

ca5e7af1c48dd10df04a0afa3662e0bbec432e15a48669f9e3af912a7519c61cf14662cf9d07a85a3cae726b34ea18e846bd4eb77e7e8152b51ba1a228b24e62
SSDEEP

12288:KSrVlG/k3LaSj6RvgQ3UyJcYm5OIvc4AC84dlWnVOUWEzQraerDZm+GKO:KUOyLa06SGbmYm5Tv8C8yWnmE8rTtmd

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

26 discord.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2096 1296 WerFault.exe Noua comanda de achizitie este atasata.exe

flow	ioc
26	discord.com

pid	pid_target	process	target process
2096	1296	WerFault.exe	Noua comanda de achizitie este atasata.exe

C:\Users\Admin\AppData\Local\Temp\Noua comanda de achizitie este atasata.exe
"C:\Users\Admin\AppData\Local\Temp\Noua comanda de achizitie este atasata.exe"
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 608
2⤵
- Program crash
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4080,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1296 -ip 1296
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-0-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1296-1-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1296-2-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1296-3-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1296-7-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download