be8b784930db373c77c4af35def8dd62bab00b25e7980a2198e6292610074aa6

Analysis

max time kernel
23s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.exe
Size 164KB
Sample240609-zerskafd56
SHA256 be8b784930db373c77c4af35def8dd62bab00b25e7980a2198e6292610074aa6
MD5 1b33dca53f947f278fa3b529c0f8944f
SHA1 fbe808950fae84260c550c508425980fa4802b47
SHA512 db82d8d45a5eea758bb45e42d6fc24c61c43cace29c78621806fe40faa6c55fae6f3af40fa07a65a10787d5cf0af3e49eb765297a96314c0fcafc35d12a0bca6
SSDEEP 3072:Jr25iC8trURiqLmnHhc83FIwaLsnyJb5PMN/bS89jfz2:p25RYrUnLYHhwwaLsnyJb5PMP2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2152	LocalefUjwRZZGA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2152	LocalefUjwRZZGA.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	LocalefUjwRZZGA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2152	1912	install.exe	28
PID 1912 wrote to memory of 2152	1912	install.exe	28
PID 1912 wrote to memory of 2152	1912	install.exe	28
PID 2152 wrote to memory of 1248	2152	LocalefUjwRZZGA.exe	29
PID 2152 wrote to memory of 1248	2152	LocalefUjwRZZGA.exe	29
PID 2152 wrote to memory of 1248	2152	LocalefUjwRZZGA.exe	29

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\LocalefUjwRZZGA.exe
  "C:\Users\Admin\AppData\LocalefUjwRZZGA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2152 -s 6852
    3⤵
    PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalefUjwRZZGA.exe

Path C:\Users\Admin\AppData\LocalefUjwRZZGA.exe
Size 138KB
SHA256 54f2e357163305a265fd3cbd6bc287c1338e691a4e6975e1e9631b0ebddb920a
MD5 d0d7e34964fdf38d5465e5e3bad009fd
SHA1 dd081d07172fd96326a810ca2f93fed0eed0e086
SHA512 b9e81cc19b7b539fd74540a616876586d73bcc24a92d4ac9ccb552a51056832a22497ab6ef23b48360213dd8beeebcdf5fcbcc5ef96d2e050b974f416d60b7ee
SSDEEP 3072:Qr25iC8trURiqLmnHhc83FIwaLsnyJb5PMN/:c25RYrUnLYHhwwaLsnyJb5PM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1912-0-0x000007FEF5F7E000-0x000007FEF5F7F000-memory.dmp

Download

memory/1912-9-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Download

memory/2152-10-0x000007FEF3833000-0x000007FEF3834000-memory.dmp

Download

memory/2152-11-0x0000000000A90000-0x0000000000ABC000-memory.dmp

Download

memory/2152-12-0x0000000000240000-0x000000000024C000-memory.dmp

Download

memory/2152-13-0x000007FEF3833000-0x000007FEF3834000-memory.dmp

Download