af9ec6de75439ef70ac160b07e6d5924eec4ec4465e5b5ed159ef040db17ca79

Analysis

max time kernel
119s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e80339df2c569ab4931d0c1d24caea0N.exe
Size 89KB
Sample240719-1edfls1bql
SHA256 af9ec6de75439ef70ac160b07e6d5924eec4ec4465e5b5ed159ef040db17ca79
MD5 0e80339df2c569ab4931d0c1d24caea0
SHA1 03773c0f7049553b468c56ca1e265b1d11d57ceb
SHA512 a0a8ea5582e0ca464b46cbcf3d8c7dcc8e8f1ceb1c9410647f3b60c20a3d2d9f5a5d00df5d8cd766e383bd510e07b5936913a9031f1d0d041881b4d87d82af0f
SSDEEP 1536:29o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:29o6fK2XqXQwhnHlqQo8Lvy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	4616	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4616	winver.exe
4616	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3516	Explorer.EXE
Token: SeCreatePagefilePrivilege	3516	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4616	winver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3516	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 4616	2380	0e80339df2c569ab4931d0c1d24caea0N.exe	84
PID 2380 wrote to memory of 4616	2380	0e80339df2c569ab4931d0c1d24caea0N.exe	84
PID 2380 wrote to memory of 4616	2380	0e80339df2c569ab4931d0c1d24caea0N.exe	84
PID 2380 wrote to memory of 4616	2380	0e80339df2c569ab4931d0c1d24caea0N.exe	84
PID 4616 wrote to memory of 3516	4616	winver.exe	56
PID 4616 wrote to memory of 2676	4616	winver.exe	44

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2676

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3516
- C:\Users\Admin\AppData\Local\Temp\0e80339df2c569ab4931d0c1d24caea0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0e80339df2c569ab4931d0c1d24caea0N.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 632
      4⤵
      Program crash
      PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4616 -ip 4616
1⤵
PID:4692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-11-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2380-0-0x00000000006D0000-0x00000000006D2000-memory.dmp

Download

memory/2380-5-0x0000000002370000-0x0000000002D70000-memory.dmp

Download

memory/2676-12-0x00007FFE5C8B0000-0x00007FFE5C8B1000-memory.dmp

Download

memory/2676-9-0x0000000000C10000-0x0000000000C16000-memory.dmp

Download

memory/2676-10-0x0000000000C10000-0x0000000000C16000-memory.dmp

Download

memory/3516-1-0x0000000002CD0000-0x0000000002CD6000-memory.dmp

Download

memory/3516-4-0x0000000002CD0000-0x0000000002CD6000-memory.dmp

Download

memory/3516-7-0x00007FFE5C72D000-0x00007FFE5C72E000-memory.dmp

Download

memory/3516-16-0x00007FFE5C8C0000-0x00007FFE5C8C1000-memory.dmp

Download

memory/4616-2-0x00000000009B0000-0x00000000009B6000-memory.dmp

Download

memory/4616-8-0x00007FFE5C690000-0x00007FFE5C885000-memory.dmp

Download

memory/4616-14-0x00000000009B0000-0x00000000009B6000-memory.dmp

Download

memory/4616-6-0x00000000779F2000-0x00000000779F3000-memory.dmp

Download