Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 04:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
MV Starship.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
MV Starship.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
MV Starship.exe
-
Size
1.1MB
-
MD5
7735fefaf6b16dd97499d0d2016dff1b
-
SHA1
598d7c0eea1ca5fee2f7d8c052a01225bcd72761
-
SHA256
3cc81b7a9a59609e3267d06fad726352660b7c2e5c896c193939aff4744d499d
-
SHA512
4df13f92972522e14497ad16051b876983caf97810bb00128030b0121289eb11cf4774b5f458ae04a0ba3b7ceb4a2b6de913dddfef357fd8a164eff3093c4ad9
-
SSDEEP
24576:IAHnh+eWsN3skA4RV1Hom2KXMmHaxnRjGf9UYfLOKlD6J1y5:Ph+ZkldoPK8YaxnRjGSYfLdRN
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5024 1200 WerFault.exe MV Starship.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
MV Starship.exepid process 1200 MV Starship.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
MV Starship.exepid process 1200 MV Starship.exe 1200 MV Starship.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
MV Starship.exepid process 1200 MV Starship.exe 1200 MV Starship.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
MV Starship.exedescription pid process target process PID 1200 wrote to memory of 1724 1200 MV Starship.exe svchost.exe PID 1200 wrote to memory of 1724 1200 MV Starship.exe svchost.exe PID 1200 wrote to memory of 1724 1200 MV Starship.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MV Starship.exe"C:\Users\Admin\AppData\Local\Temp\MV Starship.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\MV Starship.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 6962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1200 -ip 12001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-10-0x0000000003400000-0x0000000003404000-memory.dmpFilesize
16KB