Analysis
- max time kernel
119s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 18:28
General
- Target d1832886bd31bf7129fbd708123c19bbc633e4c12bde2affabbf69236f38afad.exe
- Size 219KB
- Sample240604-w4depafd3w
- SHA256 d1832886bd31bf7129fbd708123c19bbc633e4c12bde2affabbf69236f38afad
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Program crash 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1832886bd31bf7129fbd708123c19bbc633e4c12bde2affabbf69236f38afad.exe"C:\Users\Admin\AppData\Local\Temp\d1832886bd31bf7129fbd708123c19bbc633e4c12bde2affabbf69236f38afad.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$77ed3663"C:\Users\Admin\AppData\Local\Temp\$77ed3663"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 4203⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\$772c93d7"C:\Users\Admin\AppData\Local\Temp\$772c93d7"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 3923⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3296 -ip 32961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3080 -ip 30801⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
$77ed3663
memory/2652-31-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-2-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/2652-3-0x0000000007350000-0x00000000075A0000-memory.dmp
memory/2652-4-0x0000000007B50000-0x00000000080F4000-memory.dmp
memory/2652-5-0x0000000007640000-0x00000000076D2000-memory.dmp
memory/2652-6-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-11-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-29-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-45-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-39-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-51-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-57-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-55-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-53-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-49-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-47-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-43-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-41-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-37-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-35-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-27-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-33-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp
memory/2652-23-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-21-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-19-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-25-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-17-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-13-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-9-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-7-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-15-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-61-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-69-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-67-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-65-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-63-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-59-0x0000000007350000-0x000000000759A000-memory.dmp
memory/2652-4892-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/2652-4893-0x0000000005880000-0x000000000590C000-memory.dmp
memory/2652-4894-0x0000000005960000-0x00000000059AC000-memory.dmp
memory/2652-1-0x00000000005E0000-0x000000000061C000-memory.dmp
memory/2652-4909-0x00000000059F0000-0x0000000005A44000-memory.dmp
memory/2652-4933-0x0000000074BA0000-0x0000000075350000-memory.dmp