Analysis

  • max time kernel
    96s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2024 14:45

General

  • Target

    779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe

  • Size

    662KB

  • MD5

    62a83d982c702f0a42aa618a95959987

  • SHA1

    4e024ad04b914afba1efc8b161860674da40c75a

  • SHA256

    779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e

  • SHA512

    2ca5c2a71d137ae6e5e3eec856e62dd6d99911bc76e68f23eb128bd7fab7e3e1c3a70a04b5559ef62789b70c386b421b06d981b1f55ec9103282992ff91ae398

  • SSDEEP

    12288:ptnlaPwq8HRQoWR87YSdEEYunKDLnWFcyCcPMweEP:PAKHyoWR87YSGWKXccDcPfP

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe
    "C:\Users\Admin\AppData\Local\Temp\779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\Users\Admin\AppData\Local\Temp\779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe
      "C:\Users\Admin\AppData\Local\Temp\779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe"
      2⤵
        PID:3448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 996
        2⤵
        • Program crash
        PID:2496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 428 -ip 428
      1⤵
        PID:992

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nshCBDC.tmp\awjx.dll

        Filesize

        20KB

        MD5

        213e480b87636c56a73a61de53f0c3c8

        SHA1

        0425ea30b6ae2eca54a8e55e1b7950dc0f5c1412

        SHA256

        f8c73afa54aeed213fe0f60b0f3fd7e95ad292941a1dcd7cb9d94dc3b0571637

        SHA512

        7b326838f0a8a214a932f58c66a37b0d6c7972e0ec089f7528c34041b8891c4a4b71d99d7630ff5c4bcbca83cd2aa25b4e8da30bdb1755339aa7ee5d079a4d34

      • memory/428-7-0x00000000743E5000-0x00000000743E7000-memory.dmp

        Filesize

        8KB