Resubmissions

19-06-2024 02:56

240619-de4w8ssenf 10

19-06-2024 02:46

240619-c9g6aasdnh 10

19-06-2024 02:42

240619-c69fcssdlh 3

Analysis

  • max time kernel
    211s
  • max time network
    279s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-06-2024 02:46

General

  • Target

    1.2.6.0/1.2.6.0.lnk

  • Size

    1KB

  • MD5

    ed1743440a109e87c91b9702c80303aa

  • SHA1

    d0214b75e865b7375ad60753165823738f14a674

  • SHA256

    bc267a377de2a1c28b9e484188153b1593b10f6d1b9e27e7a10532dbdfb8feeb

  • SHA512

    a965901436aea141d3246b90728ceffd6721d1f58f24bc6b69b0e44c0a656e17867aeb3cd42f52a78c32137c14db4e64c67646fcfbfd639a5aafee469c392dfc

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    94.156.8.173
  • Port:
    21
  • Username:
    anonymous
  • Password:
    anonymous@

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\1.2.6.0\1.2.6.0.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Users\Admin\AppData\Local\Temp\1.2.6.0\run.dist\run.exe
      "C:\Users\Admin\AppData\Local\Temp\1.2.6.0\run.dist\run.exe"
      2⤵
        PID:1772
    • C:\Windows\system32\werfault.exe
      werfault.exe /h /shared Global\f721881715cf4f6fb8ae0cdc1a7135a7 /t 1684 /p 1772
      1⤵
        PID:4044
      • C:\Windows\system32\werfault.exe
        werfault.exe /h /shared Global\a27d3e8fdd664041b2c227d1a19377f8 /t 1684 /p 1772
        1⤵
          PID:2108

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1772-5-0x00007FF8F3950000-0x00007FF8F397A000-memory.dmp

          Filesize

          168KB

        • memory/1772-4-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-6-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-8-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-10-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-12-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-15-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-17-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-19-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-21-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB

        • memory/1772-39-0x00007FF7F5320000-0x00007FF7F6B6A000-memory.dmp

          Filesize

          24.3MB