f8cab373e5381f3124803a5db9264c100551053d277121aea1086598142b517b

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!~L@tEsT_sEtUp_4499_p@ssWord`/Setup.exe
Size

5.5MB
MD5

9d8649afd4141d960b6545998fbc423b
SHA1

3ddd700caaebab0a9d2ed640f235d4b716a505de
SHA256

db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
SHA512

0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
SSDEEP

49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2072	more.com
2728	Uhzi.au3
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2936 set thread context of 2072	2936	Setup.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	2728	WerFault.exe	32

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2936	Setup.exe
2936	Setup.exe
2072	more.com
2072	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2936	Setup.exe
2072	more.com

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2072	2936	Setup.exe	30
PID 2936 wrote to memory of 2072	2936	Setup.exe	30
PID 2936 wrote to memory of 2072	2936	Setup.exe	30
PID 2936 wrote to memory of 2072	2936	Setup.exe	30
PID 2936 wrote to memory of 2072	2936	Setup.exe	30
PID 2072 wrote to memory of 2728	2072	more.com	32
PID 2072 wrote to memory of 2728	2072	more.com	32
PID 2072 wrote to memory of 2728	2072	more.com	32
PID 2072 wrote to memory of 2728	2072	more.com	32
PID 2072 wrote to memory of 2728	2072	more.com	32
PID 2072 wrote to memory of 2728	2072	more.com	32
PID 2728 wrote to memory of 2776	2728	Uhzi.au3	33
PID 2728 wrote to memory of 2776	2728	Uhzi.au3	33
PID 2728 wrote to memory of 2776	2728	Uhzi.au3	33
PID 2728 wrote to memory of 2776	2728	Uhzi.au3	33
PID 2072 wrote to memory of 2728	2072	more.com	32

C:\Users\Admin\AppData\Local\Temp\!~L@tEsT_sEtUp_4499_p@ssWord`\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!~L@tEsT_sEtUp_4499_p@ssWord`\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 120
      4⤵
      Loads dropped DLL
      Program crash
      PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ac119050

Filesize
1.8MB

MD5
928d69c5ea2a066236d2f42e18b1d259

SHA1
dc18ed7e707ebe04d3a0ac66986dbdfd228fc518

SHA256
5554f86af507eb4ae3ebf5c11d1a9bf6e5fc7027227f5c088f219b3a1083d69f

SHA512
7c2cfd8197a5dccc95df96432880d4a2cce7e64e8eff2a18a780f1b98e0d7c4ac3116392f3938c3f1f260873d2603cceb4bcc1f3ee6c10c1acd7e8fdb414e40a

Download Submit
\Users\Admin\AppData\Local\Temp\Uhzi.au3

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/2072-12-0x00000000746A0000-0x0000000074814000-memory.dmp

Filesize
1.5MB

Download
memory/2072-27-0x00000000746A1000-0x00000000746AF000-memory.dmp

Filesize
56KB

Download
memory/2072-20-0x00000000746A0000-0x0000000074814000-memory.dmp

Filesize
1.5MB

Download
memory/2072-8-0x00000000746A1000-0x00000000746AF000-memory.dmp

Filesize
56KB

Download
memory/2072-10-0x0000000077310000-0x00000000774B9000-memory.dmp

Filesize
1.7MB

Download
memory/2072-15-0x00000000746A0000-0x0000000074814000-memory.dmp

Filesize
1.5MB

Download
memory/2728-19-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-18-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-22-0x00000000000D0000-0x0000000000127000-memory.dmp

Filesize
348KB

Download
memory/2728-29-0x00000000000D0000-0x0000000000127000-memory.dmp

Filesize
348KB

Download
memory/2728-31-0x00000000000D0000-0x0000000000127000-memory.dmp

Filesize
348KB

Download
memory/2936-5-0x0000000000120000-0x00000000006CE000-memory.dmp

Filesize
5.7MB

Download
memory/2936-0-0x00000000746A0000-0x0000000074814000-memory.dmp

Filesize
1.5MB

Download
memory/2936-1-0x0000000077310000-0x00000000774B9000-memory.dmp

Filesize
1.7MB

Download
memory/2936-6-0x00000000746A0000-0x0000000074814000-memory.dmp

Filesize
1.5MB

Download