12247d199abb0dbf81620305bdd1e90bef650f81979ae4bedd535b130d1f55e9

Analysis

max time kernel
141s
max time network
141s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12247d199abb0dbf81620305bdd1e90bef650f81979ae4bedd535b130d1f55e9.dll
Size

143KB
MD5

7c806cf272e18891b99f3bd41f53527e
SHA1

b48de6a13d8b45f9887b4341b08240038d728294
SHA256

12247d199abb0dbf81620305bdd1e90bef650f81979ae4bedd535b130d1f55e9
SHA512

0adc983cec97fcecd9af2ca71de2d62a0bfa06f60b3a412b0e7dac35117b2976498b3f38ef5eb803c7a7750d1ee834a221a8098550332335947497bc4223e9ba

Score

10^/10

persistence

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3832	1612	WerFault.exe	68

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3832 created 1612	3832	WerFault.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3832	WerFault.exe
Token: SeBackupPrivilege	3832	WerFault.exe
Token: SeDebugPrivilege	3832	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\JUSCHEDopt46t = "C:\\Windows\\SysWOW64\\rundll32.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1612	1492	rundll32.exe	68
PID 1492 wrote to memory of 1612	1492	rundll32.exe	68
PID 1492 wrote to memory of 1612	1492	rundll32.exe	68

Blacklisted process makes network request 1 IoCs

flow	pid	Process
9	1612	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12247d199abb0dbf81620305bdd1e90bef650f81979ae4bedd535b130d1f55e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12247d199abb0dbf81620305bdd1e90bef650f81979ae4bedd535b130d1f55e9.dll,#1
  2⤵
  - Adds Run entry to start application
  - Blacklisted process makes network request
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1080
    3⤵
    - Program crash
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:3832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3832-1-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/3832-11-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download