Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
31-07-2020 20:33
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe
Resource
win7
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe
Resource
win10v200722
General
-
Target
SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe
-
Size
140KB
-
MD5
c273e75105e752ed59f14f4d97683001
-
SHA1
5f1e89ae2529fd52bcad9d79a9cd933d27f3d274
-
SHA256
22d381feb748820ad07b312c2d6c9d82330b380fbf1676c82146f228d493d944
-
SHA512
0f4d178ecde5d937163c0dfd7f100098baecc3c5cef5b19293d61a8e3ede12f149788e0b04ec503756bcb73c42c027711ea75ec20385923c8e348dfa26e7ada7
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 93 IoCs
Processes:
WerFault.exeSecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 68 WerFault.exe 3952 SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe 3952 SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe -
Executes dropped EXE 1 IoCs
Processes:
sktkk.exepid process 644 sktkk.exe -
Drops file in Windows directory 2 IoCs
Processes:
SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exedescription ioc process File opened for modification C:\Windows\Tasks\sktkk.job SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe File created C:\Windows\Tasks\sktkk.job SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 api.ipify.org 10 api.ipify.org -
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 68 3952 WerFault.exe SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe 852 644 WerFault.exe sktkk.exe 604 644 WerFault.exe sktkk.exe 3848 3952 WerFault.exe SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe 1436 3952 WerFault.exe SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe 3484 644 WerFault.exe sktkk.exe 3640 644 WerFault.exe sktkk.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 68 WerFault.exe Token: SeBackupPrivilege 68 WerFault.exe Token: SeDebugPrivilege 68 WerFault.exe Token: SeDebugPrivilege 852 WerFault.exe Token: SeDebugPrivilege 604 WerFault.exe Token: SeDebugPrivilege 3848 WerFault.exe Token: SeDebugPrivilege 1436 WerFault.exe Token: SeDebugPrivilege 3484 WerFault.exe Token: SeDebugPrivilege 3640 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.c273e75105e752ed.512.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 5442⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 8722⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 8522⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\cgoq\sktkk.exeC:\ProgramData\cgoq\sktkk.exe start1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 5402⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 7282⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 6762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 9322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\cgoq\sktkk.exe
-
C:\ProgramData\cgoq\sktkk.exe
-
memory/68-2-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/68-3-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/68-5-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/604-17-0x00000000033D0000-0x00000000033D1000-memory.dmpFilesize
4KB
-
memory/604-14-0x0000000002D20000-0x0000000002D21000-memory.dmpFilesize
4KB
-
memory/644-8-0x00000000035DC000-0x00000000035DD000-memory.dmpFilesize
4KB
-
memory/644-9-0x0000000003D10000-0x0000000003D11000-memory.dmpFilesize
4KB
-
memory/852-10-0x0000000002E10000-0x0000000002E11000-memory.dmpFilesize
4KB
-
memory/852-13-0x00000000034C0000-0x00000000034C1000-memory.dmpFilesize
4KB
-
memory/1436-27-0x0000000003FA0000-0x0000000003FA1000-memory.dmpFilesize
4KB
-
memory/1436-30-0x00000000045D0000-0x00000000045D1000-memory.dmpFilesize
4KB
-
memory/3484-35-0x0000000003640000-0x0000000003641000-memory.dmpFilesize
4KB
-
memory/3484-32-0x0000000002F10000-0x0000000002F11000-memory.dmpFilesize
4KB
-
memory/3640-39-0x00000000037E0000-0x00000000037E1000-memory.dmpFilesize
4KB
-
memory/3640-36-0x0000000003130000-0x0000000003131000-memory.dmpFilesize
4KB
-
memory/3848-20-0x0000000004220000-0x0000000004221000-memory.dmpFilesize
4KB
-
memory/3848-23-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/3952-24-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/3952-31-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/3952-1-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/3952-26-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/3952-25-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/3952-0-0x0000000003661000-0x0000000003662000-memory.dmpFilesize
4KB