a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53

Analysis

max time kernel
135s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe
Size 89KB
Sample240702-bvvbma1fnd
SHA256 a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53
MD5 472d13b51c1129c19b95562e6302f686
SHA1 31c14c8da0ba3756501c483f668c275bb05d3d49
SHA512 b2fc3b084539baf7f5ee6866cf8761f0a64133f61cee40d921ec2bbb543932501d3903f9aedd96616986438ec4180068667cf4f8352018159c69e49b7142f339
SSDEEP 1536:u9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:u9o6fK2XqXQwhnHlqQo8Lvy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	1116	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	winver.exe
1116	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1116	winver.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1116	1612	a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe	81
PID 1612 wrote to memory of 1116	1612	a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe	81
PID 1612 wrote to memory of 1116	1612	a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe	81
PID 1612 wrote to memory of 1116	1612	a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe	81
PID 1116 wrote to memory of 3536	1116	winver.exe	56
PID 1116 wrote to memory of 2660	1116	winver.exe	44

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2660

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536
- C:\Users\Admin\AppData\Local\Temp\a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe
  "C:\Users\Admin\AppData\Local\Temp\a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 632
      4⤵
      Program crash
      PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1116 -ip 1116
1⤵
PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-2-0x0000000000A90000-0x0000000000A96000-memory.dmp

Download

memory/1116-8-0x00007FF9DB6F0000-0x00007FF9DB8E5000-memory.dmp

Download

memory/1116-6-0x0000000077B12000-0x0000000077B13000-memory.dmp

Download

memory/1116-13-0x0000000000A90000-0x0000000000A96000-memory.dmp

Download

memory/1612-0-0x00000000006D0000-0x00000000006D2000-memory.dmp

Download

memory/1612-5-0x0000000002360000-0x0000000002D60000-memory.dmp

Download

memory/1612-9-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2660-10-0x0000000000F70000-0x0000000000F76000-memory.dmp

Download

memory/2660-11-0x0000000000F70000-0x0000000000F76000-memory.dmp

Download

memory/3536-4-0x0000000002C70000-0x0000000002C76000-memory.dmp

Download

memory/3536-1-0x0000000002C70000-0x0000000002C76000-memory.dmp

Download

memory/3536-7-0x00007FF9DB78D000-0x00007FF9DB78E000-memory.dmp

Download