068edc2dfe9430a15b84d3f941d2c9afbf95221e92580668d03dfeca2401b8ca

Analysis

max time kernel
149s
max time network
152s
platform
windows10_x64
resource
win10v200430
submitted
19/07/2020, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tasks_166.vir.exe
Size 169KB
Sample200719-egb3czcmwe
SHA256 068edc2dfe9430a15b84d3f941d2c9afbf95221e92580668d03dfeca2401b8ca
MD5 ef7f0c98fba6735e559b5190705a5116
SHA1 b29f63f03879b4dedefdd10f4c651c69506831e7
SHA512 1cd9f7446b91aac57cfdc057fc98e178d3b4a8d96033a4791ba6f13137c5c05097624d79ad5ba1c5a441d4906dd4174d2573697a8409e1b15d00f1b63692bc30
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
516	3932	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	516	WerFault.exe
Token: SeBackupPrivilege	516	WerFault.exe
Token: SeDebugPrivilege	516	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	tasks_166.vir.exe

C:\Users\Admin\AppData\Local\Temp\tasks_166.vir.exe
"C:\Users\Admin\AppData\Local\Temp\tasks_166.vir.exe"
1⤵
- Enumerates system info in registry
PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 412
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-0-0x00000000046E0000-0x00000000046E1000-memory.dmp

Download

memory/516-1-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download