a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51

Analysis

max time kernel
35s
max time network
52s
platform
windows7_x64
resource
win7v200430
submitted
09-07-2020 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe
Size

5KB
MD5

021d86fea93d0b567f5833f74437ef85
SHA1

353d4213b2c5a82d7bfbeb2ec4d7ac928fbf74f1
SHA256

a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51
SHA512

ea6fbbe2b035fdb0663dc64bbfd793231a80ccca1ab5cd187de4167493a3347d032f33f04a230f5582035e22e2b1205b137389bdf9c979577105e6eb9a5919bc

Score

6^/10

persistence

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 1388 WerFault.exe a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe

pid	pid_target	process	target process
1016	1388	WerFault.exe	a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe

description	pid	process	target process
PID 1388 wrote to memory of 1016	1388	a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe	WerFault.exe
PID 1388 wrote to memory of 1016	1388	a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe	WerFault.exe
PID 1388 wrote to memory of 1016	1388	a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1016 WerFault.exe
1016 WerFault.exe
1016 WerFault.exe
1016 WerFault.exe

pid	process
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DiagSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe\""	a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1388	a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe
Token: SeDebugPrivilege	1016	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe
"C:\Users\Admin\AppData\Local\Temp\a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1388 -s 616
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-0-0x0000000000000000-mapping.dmp

Download
memory/1016-1-0x0000000001F50000-0x0000000001F61000-memory.dmp

Filesize
68KB

Download
memory/1016-2-0x0000000002CC0000-0x0000000002CD1000-memory.dmp

Filesize
68KB

Download