Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 20:36

General

  • Target

    2b8620bb5c22ce747db82ad31287ee5c9db897d83fa9be75db6ea2e746b537ba.exe

  • Size

    86KB

  • MD5

    a175c6b86c4abf8b97557daef940cb0d

  • SHA1

    7110f8120225288a152ec9078541fb40434056fd

  • SHA256

    2b8620bb5c22ce747db82ad31287ee5c9db897d83fa9be75db6ea2e746b537ba

  • SHA512

    bcddd4d7f0984ae354e89097a3015058fb5952365e1026214bcf4bfc511f8917300230baaa3ce262b6af6d25259215dcb37eb7068832c646b05990f85aa850c9

  • SSDEEP

    768:ZZKM11gG4ChfiPO0rfz0shcUypMC5/VKhZyg3Xf:eMDgG4ChfiPOefgsOUqQwg

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 14 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b8620bb5c22ce747db82ad31287ee5c9db897d83fa9be75db6ea2e746b537ba.exe
    "C:\Users\Admin\AppData\Local\Temp\2b8620bb5c22ce747db82ad31287ee5c9db897d83fa9be75db6ea2e746b537ba.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies registry class
    PID:2812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 336
      2⤵
      • Program crash
      PID:2236
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2812 -ip 2812
    1⤵
      PID:4396

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\System\Sysexp32.exe

            Filesize

            98KB

            MD5

            445c98de81464c3c6def3d0a382b1a02

            SHA1

            18e2c6d68f657acafcf857f7de4bb2b760f60b45

            SHA256

            fc38232e89373b1549e9df32e9ec901ac398be9fd927df6013724d3da75669f3

            SHA512

            713122b7abe0b40477cdaad44c07570042d06144167417f45eecfae651b248ab628fd26177bfd5484daa32d225a045a0588b1b0b1c1237dbf36f8676b2ed7b8b