4f3c0de5a08e918050382a42c6109fda68cc8167664065ebd98c73d761fde3f3

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
Size

759KB
MD5

6ef3cba91b136ae138380b710a104a12
SHA1

5347a8375a4faaca804d39b6e892241086be8986
SHA256

c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73
SHA512

f65fd41faa37b1eaca4f60f830fc4c22c43f91821489bbfa9340f65c16e8056cd331b4cf68d8223245cbca6c7493e837cf15b16dfe371ff0a95183a9813051c5
SSDEEP

12288:YgsrmyiqyJMbloYxlJHATl7Nn4JaywbIK/bOFNEpDg0891ZdujAC6lITYeMmR/E:QF5OyoY5ApZnRywbj/bieTi1ujAC6r37

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2576 powershell.exe

pid	process
2576	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe

description	pid	process	target process
PID 1756 set thread context of 2664	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2612 2664 WerFault.exe c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exec79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe

pid process

2576 powershell.exe
2664 c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2576 powershell.exe

pid	pid_target	process	target process
2612	2664	WerFault.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe

pid	process
2576	powershell.exe
2664	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe

description	pid	process
Token: SeDebugPrivilege	2576	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exec79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe

description	pid	process	target process
PID 1756 wrote to memory of 2576	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	powershell.exe
PID 1756 wrote to memory of 2576	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	powershell.exe
PID 1756 wrote to memory of 2576	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	powershell.exe
PID 1756 wrote to memory of 2576	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	powershell.exe
PID 1756 wrote to memory of 2664	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
PID 1756 wrote to memory of 2664	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
PID 1756 wrote to memory of 2664	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
PID 1756 wrote to memory of 2664	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
PID 1756 wrote to memory of 2664	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
PID 1756 wrote to memory of 2664	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
PID 1756 wrote to memory of 2664	1756	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
PID 2664 wrote to memory of 2612	2664	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	WerFault.exe
PID 2664 wrote to memory of 2612	2664	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	WerFault.exe
PID 2664 wrote to memory of 2612	2664	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	WerFault.exe
PID 2664 wrote to memory of 2612	2664	c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
"C:\Users\Admin\AppData\Local\Temp\c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Users\Admin\AppData\Local\Temp\c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
"C:\Users\Admin\AppData\Local\Temp\c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 36
3⤵
- Program crash
PID:2612

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-6-0x0000000005090000-0x000000000511A000-memory.dmp

Filesize
552KB

Download
memory/1756-0-0x000000007436E000-0x000000007436F000-memory.dmp

Filesize
4KB

Download
memory/1756-2-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/1756-3-0x0000000000350000-0x0000000000366000-memory.dmp

Filesize
88KB

Download
memory/1756-4-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/1756-5-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/1756-1-0x0000000000F10000-0x0000000000FD4000-memory.dmp

Filesize
784KB

Download
memory/1756-13-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2664-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2664-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2664-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2664-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download