Analysis
-
max time kernel
132s -
max time network
135s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 11:11
Static task
static1
Behavioral task
behavioral1
Sample
62bc145fa8fe6d16eb238eaf689c4c0d.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
62bc145fa8fe6d16eb238eaf689c4c0d.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
62bc145fa8fe6d16eb238eaf689c4c0d.exe
-
Size
151KB
-
MD5
62bc145fa8fe6d16eb238eaf689c4c0d
-
SHA1
1dc89387bbd77ca4331828699a72aafce85b3623
-
SHA256
b6129e3a5c30c44c577a5e3f64e2cd08d5faaaa776ec1866912b90dff5aa0493
-
SHA512
896ef2818c7747ad77baf853fe19b813e0b3409baadfea635cc95ee8535be48917a07741314597d362f9f96ffeadfa9ba30f4e1d1dd586e9a74a9f9ade3f5035
Score
8/10
Malware Config
Signatures
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3844 3820 WerFault.exe 62bc145fa8fe6d16eb238eaf689c4c0d.exe 2988 1932 WerFault.exe hnlu.exe 2536 1932 WerFault.exe hnlu.exe 2912 3820 WerFault.exe 62bc145fa8fe6d16eb238eaf689c4c0d.exe 2668 3820 WerFault.exe 62bc145fa8fe6d16eb238eaf689c4c0d.exe 3752 1932 WerFault.exe hnlu.exe 2212 1932 WerFault.exe hnlu.exe 2736 2480 WerFault.exe vjwlr.exe 3448 1932 WerFault.exe hnlu.exe 3232 3520 WerFault.exe wevkg.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3844 WerFault.exe Token: SeBackupPrivilege 3844 WerFault.exe Token: SeDebugPrivilege 3844 WerFault.exe Token: SeDebugPrivilege 2988 WerFault.exe Token: SeDebugPrivilege 2536 WerFault.exe Token: SeDebugPrivilege 2912 WerFault.exe Token: SeDebugPrivilege 2668 WerFault.exe Token: SeDebugPrivilege 3752 WerFault.exe Token: SeDebugPrivilege 2212 WerFault.exe Token: SeDebugPrivilege 3448 WerFault.exe Token: SeDebugPrivilege 2736 WerFault.exe Token: SeDebugPrivilege 3232 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 134 IoCs
Processes:
WerFault.exe62bc145fa8fe6d16eb238eaf689c4c0d.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3820 62bc145fa8fe6d16eb238eaf689c4c0d.exe 3820 62bc145fa8fe6d16eb238eaf689c4c0d.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe -
Executes dropped EXE 3 IoCs
Processes:
hnlu.exevjwlr.exewevkg.exepid process 1932 hnlu.exe 2480 vjwlr.exe 3520 wevkg.exe -
Drops file in Windows directory 5 IoCs
Processes:
62bc145fa8fe6d16eb238eaf689c4c0d.exehnlu.exevjwlr.exedescription ioc process File created C:\Windows\Tasks\hnlu.job 62bc145fa8fe6d16eb238eaf689c4c0d.exe File opened for modification C:\Windows\Tasks\hnlu.job 62bc145fa8fe6d16eb238eaf689c4c0d.exe File created C:\Windows\Tasks\aqnxvutrqonmdjagwdt.job hnlu.exe File created C:\Windows\Tasks\wevkg.job vjwlr.exe File opened for modification C:\Windows\Tasks\wevkg.job vjwlr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62bc145fa8fe6d16eb238eaf689c4c0d.exe"C:\Users\Admin\AppData\Local\Temp\62bc145fa8fe6d16eb238eaf689c4c0d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 5442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 8602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 8722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\gtmmfic\hnlu.exeC:\ProgramData\gtmmfic\hnlu.exe start1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 5362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 7162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 7042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 7322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 7322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\TEMP\vjwlr.exeC:\Windows\TEMP\vjwlr.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 5362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\tjur\wevkg.exeC:\ProgramData\tjur\wevkg.exe start1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 5402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB56B.tmp.WERInternalMetadata.xml
-
C:\ProgramData\gtmmfic\hnlu.exe
-
C:\ProgramData\gtmmfic\hnlu.exe
-
C:\ProgramData\tjur\wevkg.exe
-
C:\ProgramData\tjur\wevkg.exe
-
C:\Windows\TEMP\vjwlr.exe
-
C:\Windows\Tasks\hnlu.job
-
C:\Windows\Temp\vjwlr.exe
-
memory/1932-9-0x0000000003CE0000-0x0000000003CE1000-memory.dmpFilesize
4KB
-
memory/1932-10-0x0000000003CE0000-0x0000000003CE1000-memory.dmpFilesize
4KB
-
memory/1932-8-0x00000000033CC000-0x00000000033CD000-memory.dmpFilesize
4KB
-
memory/2212-31-0x0000000003240000-0x0000000003241000-memory.dmpFilesize
4KB
-
memory/2212-34-0x00000000039F0000-0x00000000039F1000-memory.dmpFilesize
4KB
-
memory/2480-38-0x0000000003E20000-0x0000000003E21000-memory.dmpFilesize
4KB
-
memory/2480-37-0x000000000360C000-0x000000000360D000-memory.dmpFilesize
4KB
-
memory/2536-15-0x0000000003AB0000-0x0000000003AB1000-memory.dmpFilesize
4KB
-
memory/2536-18-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/2668-23-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/2668-26-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/2736-40-0x00000000030D0000-0x00000000030D1000-memory.dmpFilesize
4KB
-
memory/2736-46-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/2912-22-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/2912-19-0x00000000040A0000-0x00000000040A1000-memory.dmpFilesize
4KB
-
memory/2988-14-0x00000000033D0000-0x00000000033D1000-memory.dmpFilesize
4KB
-
memory/2988-11-0x0000000002CA0000-0x0000000002CA1000-memory.dmpFilesize
4KB
-
memory/3232-57-0x0000000003BE0000-0x0000000003BE1000-memory.dmpFilesize
4KB
-
memory/3232-54-0x00000000034B0000-0x00000000034B1000-memory.dmpFilesize
4KB
-
memory/3448-41-0x00000000038C0000-0x00000000038C1000-memory.dmpFilesize
4KB
-
memory/3448-47-0x0000000004480000-0x0000000004481000-memory.dmpFilesize
4KB
-
memory/3520-52-0x00000000034EC000-0x00000000034ED000-memory.dmpFilesize
4KB
-
memory/3520-53-0x0000000003D30000-0x0000000003D31000-memory.dmpFilesize
4KB
-
memory/3752-30-0x00000000033E0000-0x00000000033E1000-memory.dmpFilesize
4KB
-
memory/3752-27-0x0000000002C30000-0x0000000002C31000-memory.dmpFilesize
4KB
-
memory/3820-0-0x00000000033F1000-0x00000000033F2000-memory.dmpFilesize
4KB
-
memory/3820-1-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/3844-3-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3844-2-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3844-5-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB