Analysis
-
max time kernel
11s -
max time network
7s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10/07/2024, 12:28
General
-
Target
cuh.exe
-
Size
149KB
-
MD5
e4c38ce86194ddf52b036cf64c02018f
-
SHA1
699c87e55189145b442aa46630b0ce068f3cbbc4
-
SHA256
edcbc1f121039f71e4ed4c5f23024b2f571aa4c4b03820b1accc516fd794cd21
-
SHA512
4aa410aff885755158418f7caca4fa6fb8863e042d7112b4a10d7bdb67cf7bbbbe0a2ff88be71423e1eedbf74e0dd2402f9495546d4d9b637d7f318866c19081
-
SSDEEP
3072:u047EfZOFukNuBwxp2iwmaP/ZOFukNuBwxp2iwmaP6:pCGwf9wmaPBwf9wmaP
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 32 IoCs
-
Suspicious use of SendNotifyMessage 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cuh.exe"C:\Users\Admin\AppData\Local\Temp\cuh.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 10482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 440 -ip 4401⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB