Analysis
-
max time kernel
140s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
Resource
win10v2004-20240226-en
General
-
Target
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
-
Size
720KB
-
MD5
fc0b6d3bf31be46f7d8211c234ec2672
-
SHA1
be84abaaea55263dd90d923c26d235eec475a336
-
SHA256
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889
-
SHA512
858a07223d71dcda427c3dacfc86ded49c80fb976d6899caa9c4f2740cbc2f74143e4e884a6aa8ed505f507d21b905b2c776ca495333b1e4148619e858fc08b8
-
SSDEEP
12288:QhJbM4euy6D9d9pA6etej3uC+IOJ5D9d9pAn:8LygZKnJp4
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 1336 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Executes dropped EXE 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 1336 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3504 1336 WerFault.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 4632 1336 WerFault.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 2132 1336 WerFault.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 1048 1336 WerFault.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 2112 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 1336 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exedescription pid process target process PID 2112 wrote to memory of 1336 2112 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe PID 2112 wrote to memory of 1336 2112 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe PID 2112 wrote to memory of 1336 2112 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe"C:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exeC:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 3523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 7683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 7883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2112 -ip 21121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1336 -ip 13361⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1336 -ip 13361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1336 -ip 13361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1336 -ip 13361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exeFilesize
720KB
MD5618c720e1d405bb13ad907ef242f2adb
SHA13c106214069edb4cb422169f332c4b6ee6f64f95
SHA2565ce2c433c49d355d5b626df651b3bd17233eee1cc0219ea51794af4254051d4d
SHA512c8bcd6d44e80b9646771da2c8790b3c8dd6486d550514649af33b445da02e5f17e50f66524f7a5634d94f1052b57c4c19fc1669485ae4072350a276a9bd9a8ef
-
memory/1336-7-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1336-8-0x00000000015F0000-0x0000000001626000-memory.dmpFilesize
216KB
-
memory/1336-9-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/2112-0-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2112-6-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB