cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520

Analysis

max time kernel
147s
max time network
27s
platform
windows7_x64
resource
win7v200430
submitted
17/07/2020, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520.exe
Size 701KB
Sample200717-7823pbt892
SHA256 cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520
MD5 df440b940c5398f756ed55785c9307a8
SHA1 9d189e6c51bc1cb9ff860eb4d8a0c9aef6487aee
SHA512 25cbb6a786d4405d464506659eadd946ca8f604c086898ae0cb0b05d0139b608f3ffdb365d1ec55aec2f4acb03f3c74321188cff12aa9456770851fbdee1ea74
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	888	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1400	888	cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520.exe	24
PID 888 wrote to memory of 1400	888	cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520.exe	24
PID 888 wrote to memory of 1400	888	cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520.exe	24
PID 888 wrote to memory of 1400	888	cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1400	WerFault.exe
1400	WerFault.exe
1400	WerFault.exe
1400	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\CIOdP = "C:\\DJRWGDLZ\\CIOdPO\\CIOdPOnvL.vbs"	cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520.exe

C:\Users\Admin\AppData\Local\Temp\cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520.exe
"C:\Users\Admin\AppData\Local\Temp\cf60dd8e927a419d76dfb060c649c888dacc338cc14b5e3abf5e388213fec520.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
PID:888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 7360
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-1-0x0000000002040000-0x0000000002051000-memory.dmp

Download

memory/1400-2-0x0000000002640000-0x0000000002651000-memory.dmp

Download