2ad7e2382efb6fe85a117f20f192029091cfaeebc7a17f4164b158ab63874d94

Analysis

max time kernel
144s
max time network
146s
platform
windows10_x64
resource
win10
submitted
09-07-2020 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bank transfer 101875411.exe
Size

777KB
MD5

63ae29ac0a6b9f29fc1567ecf244db7d
SHA1

1febc80f252ef14f6f62b061bb00d3250ba6dc4a
SHA256

2ad7e2382efb6fe85a117f20f192029091cfaeebc7a17f4164b158ab63874d94
SHA512

05ee6aec4e40cef36a4e8e776df346230741c4157cc6a700126248a47a349a780dd33e2c658515f1dcbef0bf9f8e3682270e00acf9bffc7bf29e27691d7334f5

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Bank transfer 101875411.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\btVpg = "C:\\GOHCSFBB\\btVpgS\\btVpgSutm.vbs"	Bank transfer 101875411.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3856 3676 WerFault.exe Bank transfer 101875411.exe

pid	pid_target	process	target process
3856	3676	WerFault.exe	Bank transfer 101875411.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3856 WerFault.exe
Token: SeBackupPrivilege 3856 WerFault.exe
Token: SeDebugPrivilege 3856 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3856	WerFault.exe
Token: SeBackupPrivilege	3856	WerFault.exe
Token: SeDebugPrivilege	3856	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Bank transfer 101875411.exe
"C:\Users\Admin\AppData\Local\Temp\Bank transfer 101875411.exe"
1⤵
- Adds Run key to start application
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 8244
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/3856-2-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download