Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 02:57

General

  • Target

    c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe

  • Size

    237KB

  • MD5

    65bdf7cdcd49fd7b8df71924a75d42bf

  • SHA1

    784b4d6f7e195e061cd8e258450514b6b180dc28

  • SHA256

    c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7

  • SHA512

    3669bcedfa34532b69cd5ec20551736ce54401e9491782a0ffd38c4b8bcbac67c4dc9483d432deb2f78a6bb8c46a86dcd7c439e8dee92bc6fc7c53faec3ad882

  • SSDEEP

    6144:mA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:mATuTAnKGwUAWVycQqgj

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2520
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe
        "C:\Users\Admin\AppData\Local\Temp\c8852bb60759c6965e16c3a9a9302f09dcd22023da188bc7aaa1303e09b65bc7.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1864
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 300
            4⤵
            • Program crash
            PID:2368
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 956
          3⤵
          • Program crash
          PID:1712
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:4180
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1864 -ip 1864
      1⤵
        PID:3384
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4592 -ip 4592
        1⤵
          PID:3808

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2520-13-0x0000000000BD0000-0x0000000000BD6000-memory.dmp
          Filesize

          24KB

        • memory/2520-19-0x0000000000BD0000-0x0000000000BD6000-memory.dmp
          Filesize

          24KB

        • memory/3488-4-0x0000000001220000-0x0000000001226000-memory.dmp
          Filesize

          24KB

        • memory/3488-5-0x0000000001220000-0x0000000001226000-memory.dmp
          Filesize

          24KB

        • memory/3488-11-0x00000000013F0000-0x00000000013F6000-memory.dmp
          Filesize

          24KB

        • memory/4592-1-0x0000000004630000-0x0000000004C88000-memory.dmp
          Filesize

          6.3MB

        • memory/4592-2-0x00000000024E0000-0x00000000024E1000-memory.dmp
          Filesize

          4KB

        • memory/4592-6-0x0000000000400000-0x000000000043F000-memory.dmp
          Filesize

          252KB

        • memory/4592-10-0x0000000005740000-0x0000000006140000-memory.dmp
          Filesize

          10.0MB

        • memory/4592-14-0x0000000005740000-0x0000000006140000-memory.dmp
          Filesize

          10.0MB

        • memory/4592-18-0x0000000004630000-0x0000000004C88000-memory.dmp
          Filesize

          6.3MB