025088f7c1db9c5f9472badb6d1c4f119868b922c52b6bed896e8e2ff746f955

Analysis

max time kernel
53s
max time network
53s
platform
windows7_x64
resource
win7
submitted
16/07/2020, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO_5635635373.com.exe
Size 701KB
Sample200716-zehs2f7d6n
SHA256 025088f7c1db9c5f9472badb6d1c4f119868b922c52b6bed896e8e2ff746f955
MD5 449afa12bc0b10528057490c0b30b91d
SHA1 0709d44619552d91f97718e96129620b323f8ba3
SHA512 8c77be4ffa5e7b2843e1c8dde9f95226c76c31643c0bd571bfaf80b780a40ecda91ce58cc332d994d73711b74f4bef571711b3c4b58395748c4a201c148e659d
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
616	1100	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 616	1100	PO_5635635373.com.exe	24
PID 1100 wrote to memory of 616	1100	PO_5635635373.com.exe	24
PID 1100 wrote to memory of 616	1100	PO_5635635373.com.exe	24
PID 1100 wrote to memory of 616	1100	PO_5635635373.com.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\vslWC = "C:\\AVGLFESB\\vslWCF\\vslWCFVas.vbs"	PO_5635635373.com.exe

C:\Users\Admin\AppData\Local\Temp\PO_5635635373.com.exe
"C:\Users\Admin\AppData\Local\Temp\PO_5635635373.com.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 7356
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-1-0x0000000002000000-0x0000000002011000-memory.dmp

Download

memory/616-2-0x0000000002540000-0x0000000002551000-memory.dmp

Download