35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348

Analysis

max time kernel
131s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe
Size

225KB
MD5

687be4cd8820433172a4219065584405
SHA1

187b44109b334c648db0e7bd80cf9ae7cf3ef933
SHA256

35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348
SHA512

3bae63651b6ff743d4235323c11c3fac018b9ff8fec44bda80d274c52d0209ebfbba2758ebff2fd7c441117d9dc4ee4a42554feaabd5f5cdbeb4f6a06130b4e4
SSDEEP

6144:4A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:4ATuTAnKGwUAW3ycQqgf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4684	2968	WerFault.exe	winver.exe
384	4032	WerFault.exe	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe

pid	process
4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe
4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

winver.exe35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe

pid process

2968 winver.exe
4032 35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe

pid	process
2968	winver.exe
4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exewinver.exe

description	pid	process	target process
PID 4032 wrote to memory of 2968	4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe	winver.exe
PID 4032 wrote to memory of 2968	4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe	winver.exe
PID 4032 wrote to memory of 2968	4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe	winver.exe
PID 4032 wrote to memory of 2968	4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe	winver.exe
PID 2968 wrote to memory of 3440	2968	winver.exe	Explorer.EXE
PID 4032 wrote to memory of 3440	4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe	Explorer.EXE
PID 4032 wrote to memory of 2464	4032	35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe	svchost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Users\Admin\AppData\Local\Temp\35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe
"C:\Users\Admin\AppData\Local\Temp\35a03111f66189ffbf1d902b447503f47eb2b3b2dc790ae8b16a3636b059c348.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4032

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 300
4⤵
- Program crash
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 940
3⤵
- Program crash
PID:384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2968 -ip 2968
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4032 -ip 4032
1⤵
PID:3552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-12-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2464-18-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3440-4-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/3440-5-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/3440-10-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4032-1-0x00000000046B0000-0x0000000004D08000-memory.dmp

Filesize
6.3MB

Download
memory/4032-2-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/4032-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4032-9-0x0000000005AC0000-0x00000000064C0000-memory.dmp

Filesize
10.0MB

Download
memory/4032-14-0x0000000005AC0000-0x00000000064C0000-memory.dmp

Filesize
10.0MB

Download
memory/4032-17-0x00000000046B0000-0x0000000004D08000-memory.dmp

Filesize
6.3MB

Download