Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 19:59

General

  • Target

    maxx[1].exe

  • Size

    311KB

  • MD5

    5336c524e14753aeacf55d47d243a5c7

  • SHA1

    57dd79737e08b2669fec5926fb6d283e36fccee3

  • SHA256

    58de41e1c48a304c1f7f289fe5c8976d82b8968aae89497adf7c60cda25deaaf

  • SHA512

    9237b2e210b4c9c2a61baec0306d826f0b93fe7f52734ca0fe59a87aa23a453466320ecc49b728ce87bc26d1884e3a7e6b8d0c683497bc10891a5fb88dd5feac

  • SSDEEP

    6144:mbE/HUbSRS5yHZIHRAFP9+yETiVl4e9hwuIfLNEWNLRlRf:mb/iXsWt9+yFV9auOVfj

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\maxx[1].exe
    "C:\Users\Admin\AppData\Local\Temp\maxx[1].exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Users\Admin\AppData\Local\Temp\maxx[1].exe
      "C:\Users\Admin\AppData\Local\Temp\maxx[1].exe"
      2⤵
        PID:2132
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1048
        2⤵
        • Program crash
        PID:2564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4516 -ip 4516
      1⤵
        PID:3004

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsvADF4.tmp\iglq.dll

        Filesize

        121KB

        MD5

        07ed356bb53669a56a3d6d04093d1b49

        SHA1

        6c480a1af955ee2633020a0eb2807004fe336f10

        SHA256

        c205c4b93e7dff6cf6e2e301b9bc35668448db47913cef5d30ec78cdeeb16aaf

        SHA512

        1fbdeb195ca1833b5a0edcb62e535dc4deb61b641638dcd78951d4bb476f11780d91834aad3eb5f3f570ed65b599a372f0688226a805fabdb5785d5b9f32f4a9

      • memory/4516-6-0x0000000074E0C000-0x0000000074E0E000-memory.dmp

        Filesize

        8KB