Analysis
-
max time kernel
1049s -
max time network
458s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 15:28
Behavioral task
behavioral1
Sample
FA AntiVira Prosses Watch.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
iubhnuerfwiuherwfiuhewfiuhewfiuiuefwuihefwuihewfuhewfuewfueuwfhi.bat
Resource
win10v2004-20240426-en
General
-
Target
FA AntiVira Prosses Watch.exe
-
Size
7.1MB
-
MD5
caa42dc6f730560ba4d998187f0271ef
-
SHA1
da89545ced74d4f7f5b7550d62ee738a37d156bc
-
SHA256
f2d01f2c7f9922794e07a21cbe62be87e1ce52e7384834f1065c05ca73541b25
-
SHA512
b305ecc64bd57db6eef344e3116ab4770b905efc632dc65b2fd866e52574d1cf48ec61a09df485303a056b9686649816abf0be3e7a04c1cc1499e6d93f4c6524
-
SSDEEP
196608:1s+WA1HeT39IigheE9TFa0Z8DOjCdylNownzbQWa0ngx:/1+TtIibY9Z8D8CclyUnwigx
Malware Config
Signatures
-
Loads dropped DLL 11 IoCs
Processes:
FA AntiVira Prosses Watch.exepid process 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
FA AntiVira Prosses Watch.exepid process 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe 3452 FA AntiVira Prosses Watch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
FA AntiVira Prosses Watch.exedescription pid process Token: SeDebugPrivilege 3452 FA AntiVira Prosses Watch.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
FA AntiVira Prosses Watch.exedescription pid process target process PID 3344 wrote to memory of 3452 3344 FA AntiVira Prosses Watch.exe FA AntiVira Prosses Watch.exe PID 3344 wrote to memory of 3452 3344 FA AntiVira Prosses Watch.exe FA AntiVira Prosses Watch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe"C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe"C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\VCRUNTIME140.dllFilesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\VCRUNTIME140_1.dllFilesize
48KB
MD5f8dfa78045620cf8a732e67d1b1eb53d
SHA1ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\_bz2.pydFilesize
83KB
MD5223fd6748cae86e8c2d5618085c768ac
SHA1dcb589f2265728fe97156814cbe6ff3303cd05d3
SHA256f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb
SHA5129c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\_ctypes.pydFilesize
122KB
MD5bbd5533fc875a4a075097a7c6aba865e
SHA1ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00
SHA256be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570
SHA51223ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\_decimal.pydFilesize
245KB
MD53055edf761508190b576e9bf904003aa
SHA1f0dc8d882b5cd7955cc6dfc8f9834f70a83c7890
SHA256e4104e47399d3f635a14d649f61250e9fd37f7e65c81ffe11f099923f8532577
SHA51287538fe20bd2c1150a8fefd0478ffd32e2a9c59d22290464bf5dfb917f6ac7ec874f8b1c70d643a4dc3dd32cbe17e7ea40c0be3ea9dd07039d94ab316f752248
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\_hashlib.pydFilesize
64KB
MD5eedb6d834d96a3dffffb1f65b5f7e5be
SHA1ed6735cfdd0d1ec21c7568a9923eb377e54b308d
SHA25679c4cde23397b9a35b54a3c2298b3c7a844454f4387cb0693f15e4facd227dd2
SHA512527bd7bb2f4031416762595f4ce24cbc6254a50eaf2cc160b930950c4f2b3f5e245a486972148c535f8cd80c78ec6fa8c9a062085d60db8f23d4b21e8ae4c0ad
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\_lzma.pydFilesize
156KB
MD505e8b2c429aff98b3ae6adc842fb56a3
SHA1834ddbced68db4fe17c283ab63b2faa2e4163824
SHA256a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c
SHA512badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\_socket.pydFilesize
81KB
MD5dc06f8d5508be059eae9e29d5ba7e9ec
SHA1d666c88979075d3b0c6fd3be7c595e83e0cb4e82
SHA2567daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a
SHA51257eb36bc1e9be20c85c34b0a535b2349cb13405d60e752016e23603c4648939f1150e4dbebc01ec7b43eb1a6947c182ccb8a806e7e72167ad2e9d98d1fd94ab3
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\_wmi.pydFilesize
35KB
MD57ec3fc12c75268972078b1c50c133e9b
SHA173f9cf237fe773178a997ad8ec6cd3ac0757c71e
SHA2561a105311a5ed88a31472b141b4b6daa388a1cd359fe705d9a7a4aba793c5749f
SHA512441f18e8ce07498bc65575e1ae86c1636e1ceb126af937e2547710131376be7b4cb0792403409a81b5c6d897b239f26ec9f36388069e324249778a052746795e
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\base_library.zipFilesize
1.3MB
MD508332a62eb782d03b959ba64013ac5bc
SHA1b70b6ae91f1bded398ca3f62e883ae75e9966041
SHA2568584f0eb44456a275e3bc69626e3acad595546fd78de21a946b2eb7d6ba02288
SHA512a58e4a096d3ce738f6f93477c9a73ddbfcb4b82d212c0a19c0cf9e07f1e62b2f477a5dd468cd31cc5a13a73b93fa17f64d6b516afef2c56d38ede1ace35cf087
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\libcrypto-3.dllFilesize
5.0MB
MD5e547cf6d296a88f5b1c352c116df7c0c
SHA1cafa14e0367f7c13ad140fd556f10f320a039783
SHA25605fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA5129f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\libffi-8.dllFilesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\psutil\_psutil_windows.pydFilesize
65KB
MD53cba71b6bc59c26518dc865241add80a
SHA17e9c609790b1de110328bbbcbb4cd09b7150e5bd
SHA256e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
SHA5123ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\python3.DLLFilesize
66KB
MD579b02450d6ca4852165036c8d4eaed1f
SHA1ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4
SHA256d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
SHA51247044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\python312.dllFilesize
6.6MB
MD53c388ce47c0d9117d2a50b3fa5ac981d
SHA1038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\select.pydFilesize
29KB
MD592b440ca45447ec33e884752e4c65b07
SHA15477e21bb511cc33c988140521a4f8c11a427bcc
SHA256680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3
SHA51240e60e1d1445592c5e8eb352a4052db28b1739a29e16b884b0ba15917b058e66196988214ce473ba158704837b101a13195d5e48cb1dc2f07262dfecfe8d8191
-
C:\Users\Admin\AppData\Local\Temp\_MEI33442\unicodedata.pydFilesize
1.1MB
MD516be9a6f941f1a2cb6b5fca766309b2c
SHA117b23ae0e6a11d5b8159c748073e36a936f3316a
SHA25610ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04
SHA51264b7ecc58ae7cf128f03a0d5d5428aaa0d4ad4ae7e7d19be0ea819bbbf99503836bfe4946df8ee3ab8a92331fdd002ab9a9de5146af3e86fef789ce46810796b