Analysis

  • max time kernel
    137s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 00:58

General

  • Target

    95c096420450e502c8a035eec7c8a1a7622e3930a1e7a3af7c66e90e1227f664.exe

  • Size

    225KB

  • MD5

    7e776e7db06e3361750423b01e9ed6a0

  • SHA1

    7b0efba58cb2e385f43ce73f2261c8fecd19792d

  • SHA256

    95c096420450e502c8a035eec7c8a1a7622e3930a1e7a3af7c66e90e1227f664

  • SHA512

    a15069b8493c12bd10e3db02004b78c66f4a133071d22438b95dcffc1f20e1a643428b7d6786ec35efd8964eaac42d215fc9c7bed5651e3af95aee98b84d2308

  • SSDEEP

    6144:dA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:dATuTAnKGwUAW3ycQqgf

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3012
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3380
      • C:\Users\Admin\AppData\Local\Temp\95c096420450e502c8a035eec7c8a1a7622e3930a1e7a3af7c66e90e1227f664.exe
        "C:\Users\Admin\AppData\Local\Temp\95c096420450e502c8a035eec7c8a1a7622e3930a1e7a3af7c66e90e1227f664.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:852
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1020
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 300
            4⤵
            • Program crash
            PID:876
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 888
          3⤵
          • Program crash
          PID:4004
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:1184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1020 -ip 1020
      1⤵
        PID:1620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 852 -ip 852
        1⤵
          PID:3280

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/852-1-0x0000000004630000-0x0000000004C88000-memory.dmp
          Filesize

          6.3MB

        • memory/852-2-0x0000000003D80000-0x0000000003D81000-memory.dmp
          Filesize

          4KB

        • memory/852-6-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

        • memory/852-11-0x0000000005740000-0x0000000006140000-memory.dmp
          Filesize

          10.0MB

        • memory/852-13-0x0000000005740000-0x0000000006140000-memory.dmp
          Filesize

          10.0MB

        • memory/852-17-0x0000000004630000-0x0000000004C88000-memory.dmp
          Filesize

          6.3MB

        • memory/3012-12-0x00000000005E0000-0x00000000005E6000-memory.dmp
          Filesize

          24KB

        • memory/3012-18-0x00000000005E0000-0x00000000005E6000-memory.dmp
          Filesize

          24KB

        • memory/3380-5-0x0000000001200000-0x0000000001206000-memory.dmp
          Filesize

          24KB

        • memory/3380-4-0x0000000001200000-0x0000000001206000-memory.dmp
          Filesize

          24KB

        • memory/3380-10-0x0000000001270000-0x0000000001276000-memory.dmp
          Filesize

          24KB