6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7
submitted
16/07/2020, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799.exe
Size 701KB
Sample200716-tzskd25ymj
SHA256 6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799
MD5 9cf27d3c9abce09f7d740d1d62054ee9
SHA1 805690cca84708c7f5fc19a362c2c96ab3ca957a
SHA512 b553bf193891afc542535673b29d783081abe6a09fa563a617ef0131c11d671b01acfabde64b157b93b85b8020f0a13921ca2430b650ee2604e3e212aff7be3e
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1016	1464	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1016	1464	6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799.exe	24
PID 1464 wrote to memory of 1016	1464	6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799.exe	24
PID 1464 wrote to memory of 1016	1464	6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799.exe	24
PID 1464 wrote to memory of 1016	1464	6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\dZVRG = "C:\\AVGLFESB\\dZVRGS\\dZVRGSsaK.vbs"	6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799.exe

C:\Users\Admin\AppData\Local\Temp\6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799.exe
"C:\Users\Admin\AppData\Local\Temp\6b95bdd0d0a511eb1fb20709941e92eb049f4e246b5615554090520a9a509799.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 7360
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-1-0x0000000001EB0000-0x0000000001EC1000-memory.dmp

Download

memory/1016-2-0x00000000024F0000-0x0000000002501000-memory.dmp

Download