Analysis

  • max time kernel
    114s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 10:42

General

  • Target

    40a8278ddc516f38960e65e87c5d58f0N.exe

  • Size

    237KB

  • MD5

    40a8278ddc516f38960e65e87c5d58f0

  • SHA1

    4590ef33d7c8ada7b6d0680c825c9cf61a203f22

  • SHA256

    1186b5b49e01796f359fc0f584aeef545083cb6bc6d3ebb1a158e1b67fdfa5b8

  • SHA512

    8d6641611bab5439dc409ba2a8d91fe20ad296298f32cebee29db1bef864a42e33afaa083e08a4b0b4a613f3ebd0bc439e3e0fe138edb1452161fc232097f7d0

  • SSDEEP

    6144:0A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:0ATuTAnKGwUAWVycQqgj

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2676
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3460
      • C:\Users\Admin\AppData\Local\Temp\40a8278ddc516f38960e65e87c5d58f0N.exe
        "C:\Users\Admin\AppData\Local\Temp\40a8278ddc516f38960e65e87c5d58f0N.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 300
            4⤵
            • Program crash
            PID:2216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 872
          3⤵
          • Program crash
          PID:4304
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3364,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
      1⤵
        PID:5012
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
        1⤵
        • Modifies data under HKEY_USERS
        PID:844
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1180 -ip 1180
        1⤵
          PID:532
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1724 -ip 1724
          1⤵
            PID:4208

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1724-16-0x0000000005820000-0x0000000006220000-memory.dmp

            Filesize

            10.0MB

          • memory/1724-3-0x0000000003D80000-0x0000000003D81000-memory.dmp

            Filesize

            4KB

          • memory/1724-22-0x0000000004710000-0x0000000005812000-memory.dmp

            Filesize

            17.0MB

          • memory/1724-12-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/1724-5-0x0000000003D80000-0x0000000003D81000-memory.dmp

            Filesize

            4KB

          • memory/1724-6-0x0000000003D80000-0x0000000003D81000-memory.dmp

            Filesize

            4KB

          • memory/1724-7-0x0000000003D80000-0x0000000003D81000-memory.dmp

            Filesize

            4KB

          • memory/1724-8-0x0000000003D80000-0x0000000003D81000-memory.dmp

            Filesize

            4KB

          • memory/1724-24-0x0000000004710000-0x0000000004D68000-memory.dmp

            Filesize

            6.3MB

          • memory/1724-2-0x00000000044F0000-0x00000000044F1000-memory.dmp

            Filesize

            4KB

          • memory/1724-4-0x0000000003D80000-0x0000000003D81000-memory.dmp

            Filesize

            4KB

          • memory/1724-20-0x0000000005820000-0x0000000006220000-memory.dmp

            Filesize

            10.0MB

          • memory/1724-1-0x0000000004710000-0x0000000004D68000-memory.dmp

            Filesize

            6.3MB

          • memory/2676-19-0x00000000001A0000-0x00000000001A6000-memory.dmp

            Filesize

            24KB

          • memory/2676-25-0x00000000001A0000-0x00000000001A6000-memory.dmp

            Filesize

            24KB

          • memory/3460-17-0x0000000002070000-0x0000000002076000-memory.dmp

            Filesize

            24KB

          • memory/3460-11-0x0000000002060000-0x0000000002066000-memory.dmp

            Filesize

            24KB

          • memory/3460-10-0x0000000002060000-0x0000000002066000-memory.dmp

            Filesize

            24KB