Analysis
- max time kernel
150s - max time network
139s - platform
windows7_x64 - resource
win7 - submitted
23/07/2020, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
wertyse.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
wertyse.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target wertyse.exe
- Size 872KB
- Sample200723-vmahleh64j
- SHA256 83ef26bdf4b6b513417a97c8997aa2152bc0fb0f0af9d0b30cf6a46d4959ce38
- MD5 80252ba2a3af422187e143fccc6ef54e
- SHA1 027fb65eeb5c667fa902df9c22861e753da323ca
- SHA512 3a8cc798e234dd3dd0128fedc7f45bbbecb2b6464a5d7a8005efa32acaddae96436891cdfd04d4b711f58e87367546c996fa94b4dc2fb843b4e83699d76260b5
- MD5 SHA1 SHA512
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 1520 1156 WerFault.exe 23 - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1156 wertyse.exe Token: SeDebugPrivilege 1484 AddInProcess32.exe Token: SeDebugPrivilege 276 cmmon32.exe Token: SeDebugPrivilege 1520 WerFault.exe Token: SeShutdownPrivilege 1248 Explorer.EXE - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 1156 wertyse.exe 1156 wertyse.exe 1156 wertyse.exe 1484 AddInProcess32.exe 1484 AddInProcess32.exe 276 cmmon32.exe 276 cmmon32.exe 1156 wertyse.exe 1156 wertyse.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe 276 cmmon32.exe - Loads dropped DLL 1 IoCs
pid Process 1156 wertyse.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1484 1156 wertyse.exe 24 PID 1156 wrote to memory of 1484 1156 wertyse.exe 24 PID 1156 wrote to memory of 1484 1156 wertyse.exe 24 PID 1156 wrote to memory of 1484 1156 wertyse.exe 24 PID 1156 wrote to memory of 1484 1156 wertyse.exe 24 PID 1156 wrote to memory of 1484 1156 wertyse.exe 24 PID 1156 wrote to memory of 1484 1156 wertyse.exe 24 PID 1248 wrote to memory of 276 1248 Explorer.EXE 25 PID 1248 wrote to memory of 276 1248 Explorer.EXE 25 PID 1248 wrote to memory of 276 1248 Explorer.EXE 25 PID 1248 wrote to memory of 276 1248 Explorer.EXE 25 PID 276 wrote to memory of 836 276 cmmon32.exe 26 PID 276 wrote to memory of 836 276 cmmon32.exe 26 PID 276 wrote to memory of 836 276 cmmon32.exe 26 PID 276 wrote to memory of 836 276 cmmon32.exe 26 PID 1156 wrote to memory of 1520 1156 wertyse.exe 28 PID 1156 wrote to memory of 1520 1156 wertyse.exe 28 PID 1156 wrote to memory of 1520 1156 wertyse.exe 28 PID 1156 wrote to memory of 1520 1156 wertyse.exe 28 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1156 set thread context of 1484 1156 wertyse.exe 24 PID 1484 set thread context of 1248 1484 AddInProcess32.exe 20 PID 276 set thread context of 1248 276 cmmon32.exe 20 - Executes dropped EXE 1 IoCs
pid Process 1484 AddInProcess32.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1484 AddInProcess32.exe 1484 AddInProcess32.exe 1484 AddInProcess32.exe 276 cmmon32.exe 276 cmmon32.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\wertyse.exe"C:\Users\Admin\AppData\Local\Temp\wertyse.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:1484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 7563⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:276 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵PID:836
-
-