Analysis
- max time kernel
27s - max time network
68s - platform
windows10_x64 - resource
win10v20201028 - submitted
03/11/2020, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
6c74e0f75b6c76e554aa5ad5de71c797.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6c74e0f75b6c76e554aa5ad5de71c797.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 6c74e0f75b6c76e554aa5ad5de71c797.exe
- Size 572KB
- Sample201103-b2jnz75el2
- SHA256 bf2a8bc9eaad0f99ea68a6daf21dae9acf7c46798e765c59ac2575415dcdadd0
- MD5 6c74e0f75b6c76e554aa5ad5de71c797
- SHA1 c6f2ee92d52551021a6dfeea0e246557955aae75
- SHA512 8487f51769617157b3ea72dd46db2b23fccaa7005a1191697a0dd633eb330580b53332b6aa3ef443a891b82473cc54f8ef84072217813963d49bf37842424258
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 ip-api.com - Program crash 11 IoCs
pid pid_target Process procid_target 3344 884 WerFault.exe 68 2896 884 WerFault.exe 68 2984 884 WerFault.exe 68 416 884 WerFault.exe 68 808 884 WerFault.exe 68 2828 884 WerFault.exe 68 2092 884 WerFault.exe 68 2592 884 WerFault.exe 68 3988 884 WerFault.exe 68 1096 884 WerFault.exe 68 3132 884 WerFault.exe 68 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6c74e0f75b6c76e554aa5ad5de71c797.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6c74e0f75b6c76e554aa5ad5de71c797.exe - Suspicious behavior: EnumeratesProcesses 154 IoCs
pid Process 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 3344 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2896 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 2592 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeRestorePrivilege 3344 WerFault.exe Token: SeBackupPrivilege 3344 WerFault.exe Token: SeDebugPrivilege 3344 WerFault.exe Token: SeDebugPrivilege 2896 WerFault.exe Token: SeDebugPrivilege 2984 WerFault.exe Token: SeDebugPrivilege 416 WerFault.exe Token: SeDebugPrivilege 808 WerFault.exe Token: SeDebugPrivilege 2828 WerFault.exe Token: SeDebugPrivilege 2092 WerFault.exe Token: SeDebugPrivilege 2592 WerFault.exe Token: SeDebugPrivilege 3988 WerFault.exe Token: SeDebugPrivilege 1096 WerFault.exe Token: SeDebugPrivilege 3132 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c74e0f75b6c76e554aa5ad5de71c797.exe"C:\Users\Admin\AppData\Local\Temp\6c74e0f75b6c76e554aa5ad5de71c797.exe"1⤵
- Checks processor information in registry
PID:884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 7802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 3282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 16082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 16682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 15042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 16762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 18722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 19202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 18522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3132
-