Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:06
Static task
static1
Behavioral task
behavioral1
Sample
0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe
Resource
win7-20240704-en
General
-
Target
0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe
-
Size
2.0MB
-
MD5
696e729e0e69045953fe96ed934c1ec1
-
SHA1
04b83ff116c53bec63da9601f4711f81507f51bc
-
SHA256
0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e
-
SHA512
e1a892f0058d7dbbf788442329c6fca373584601f53d4372f6904d588079f40256672d436efafe923b15fc401518699f28c6bde76004d81cedf7148afcea73f7
-
SSDEEP
24576:Jzs3yG2Rwd14jK42aMQDJoAOM08/85RkptVIJqYatr0zAiX90z/F0jsFB3SQk:ZvRwdG2NcOMjUfkptVxYaB0zj0yjoB2
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 476 Process not Found 2788 alg.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\14832ff0d03a5d9e.bin alg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1252 0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1836 1252 0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe 31 PID 1252 wrote to memory of 1836 1252 0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe 31 PID 1252 wrote to memory of 1836 1252 0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe"C:\Users\Admin\AppData\Local\Temp\0c1355202a3770b6072e0ae372c09672d8ca956414ad65e7f1e8bd00603f045e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1252 -s 3322⤵PID:1836
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2788
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD52f22541a729667b256acc8ea46dbb1ef
SHA1f75f93b9f9c4564931ae954c3d7fc08e7f52ad4b
SHA256d97ea22613e8160f8725c1dcd4ea1130894ac6e564aa18cca347ef758a761db5
SHA51236102a23da27ffcbaa7315ceaf64aa4160746126d3c4f56574d027ead6eccf23d710b2569d080c9ed6fdbffbad7ef67b87aa337fe25a59217a85a334bd7f72fd