Analysis
-
max time kernel
118s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 03:08
Static task
static1
Behavioral task
behavioral1
Sample
56fdf685e1da12c61fc2059ee14a4750N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
56fdf685e1da12c61fc2059ee14a4750N.exe
Resource
win10v2004-20240709-en
General
-
Target
56fdf685e1da12c61fc2059ee14a4750N.exe
-
Size
225KB
-
MD5
56fdf685e1da12c61fc2059ee14a4750
-
SHA1
b7d07db1fb549cd56f350cbb2304a36fc9681350
-
SHA256
e473c3fc67e1df1f3e7632cb92b542c0f518d8168dbe1f312aa40ab094b247da
-
SHA512
c0e053a8c69e32b11b2f0e77508563671ce55e8db63483375af20cc74aa6937b7a09f188062b7dd681b4282f88ac1c03629e8ae8d96b94be55038771a6c69e72
-
SSDEEP
6144:hA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:hATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1924 3424 WerFault.exe winver.exe 1936 3568 WerFault.exe 56fdf685e1da12c61fc2059ee14a4750N.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
56fdf685e1da12c61fc2059ee14a4750N.exepid process 3568 56fdf685e1da12c61fc2059ee14a4750N.exe 3568 56fdf685e1da12c61fc2059ee14a4750N.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3544 Explorer.EXE Token: SeCreatePagefilePrivilege 3544 Explorer.EXE Token: SeShutdownPrivilege 3544 Explorer.EXE Token: SeCreatePagefilePrivilege 3544 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
winver.exe56fdf685e1da12c61fc2059ee14a4750N.exepid process 3424 winver.exe 3568 56fdf685e1da12c61fc2059ee14a4750N.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3544 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
56fdf685e1da12c61fc2059ee14a4750N.exewinver.exedescription pid process target process PID 3568 wrote to memory of 3424 3568 56fdf685e1da12c61fc2059ee14a4750N.exe winver.exe PID 3568 wrote to memory of 3424 3568 56fdf685e1da12c61fc2059ee14a4750N.exe winver.exe PID 3568 wrote to memory of 3424 3568 56fdf685e1da12c61fc2059ee14a4750N.exe winver.exe PID 3568 wrote to memory of 3424 3568 56fdf685e1da12c61fc2059ee14a4750N.exe winver.exe PID 3424 wrote to memory of 3544 3424 winver.exe Explorer.EXE PID 3568 wrote to memory of 3544 3568 56fdf685e1da12c61fc2059ee14a4750N.exe Explorer.EXE PID 3568 wrote to memory of 2484 3568 56fdf685e1da12c61fc2059ee14a4750N.exe sihost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\56fdf685e1da12c61fc2059ee14a4750N.exe"C:\Users\Admin\AppData\Local\Temp\56fdf685e1da12c61fc2059ee14a4750N.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 3004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 10083⤵
- Program crash
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3568 -ip 35681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2484-13-0x00000000002E0000-0x00000000002E6000-memory.dmpFilesize
24KB
-
memory/2484-19-0x00000000002E0000-0x00000000002E6000-memory.dmpFilesize
24KB
-
memory/3544-5-0x0000000000980000-0x0000000000986000-memory.dmpFilesize
24KB
-
memory/3544-4-0x0000000000980000-0x0000000000986000-memory.dmpFilesize
24KB
-
memory/3544-10-0x00000000009B0000-0x00000000009B6000-memory.dmpFilesize
24KB
-
memory/3568-1-0x0000000004750000-0x0000000004DA8000-memory.dmpFilesize
6.3MB
-
memory/3568-2-0x0000000003E10000-0x0000000003E11000-memory.dmpFilesize
4KB
-
memory/3568-6-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3568-9-0x0000000005860000-0x0000000006260000-memory.dmpFilesize
10.0MB
-
memory/3568-14-0x0000000005860000-0x0000000006260000-memory.dmpFilesize
10.0MB
-
memory/3568-18-0x0000000004750000-0x0000000004DA8000-memory.dmpFilesize
6.3MB