Analysis
-
max time kernel
101s -
resource
win10v191014 -
submitted
09-01-2020 09:55
Task
task1
Sample
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe
Resource
win10v191014
0 signatures
General
-
Target
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
-
Sample
200109-9cw38n1aex
-
SHA256
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
Score
10/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Program crash 2 IoCs
pid Process 5044 WerFault.exe 4680 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 5044 WerFault.exe Token: SeBackupPrivilege 5044 WerFault.exe Token: SeDebugPrivilege 5044 WerFault.exe Token: SeDebugPrivilege 4680 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5044 WerFault.exe 4680 WerFault.exe -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4680 created 4988 4680 WerFault.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe"C:\Users\Admin\AppData\Local\Temp\0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe"1⤵PID:4988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 6162⤵
- Checks processor information in registry
- Enumerates system info in registry
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 6082⤵
- Checks processor information in registry
- Enumerates system info in registry
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4680
-