Analysis
-
max time kernel
35s -
max time network
52s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 13:47
Static task
static1
Behavioral task
behavioral1
Sample
a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe
-
Size
5KB
-
MD5
021d86fea93d0b567f5833f74437ef85
-
SHA1
353d4213b2c5a82d7bfbeb2ec4d7ac928fbf74f1
-
SHA256
a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51
-
SHA512
ea6fbbe2b035fdb0663dc64bbfd793231a80ccca1ab5cd187de4167493a3347d032f33f04a230f5582035e22e2b1205b137389bdf9c979577105e6eb9a5919bc
Score
6/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1016 1388 WerFault.exe a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exedescription pid process target process PID 1388 wrote to memory of 1016 1388 a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe WerFault.exe PID 1388 wrote to memory of 1016 1388 a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe WerFault.exe PID 1388 wrote to memory of 1016 1388 a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe WerFault.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DiagSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe\"" a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1388 a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe Token: SeDebugPrivilege 1016 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe"C:\Users\Admin\AppData\Local\Temp\a998f6728f0b6a94aed57893be633446488a36b810b9142709a3515f9f039f51.exe"1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1388 -s 6162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken