Analysis
- max time kernel
97s - max time network
126s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/11/2020, 18:02
General
- Target 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe
- Size 853KB
- Sample201108-55cspc9aws
- SHA256 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Modifies Installed Components in the registry 2 TTPs
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Program crash 9 IoCs
- Modifies Control Panel 3 IoCs
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 148 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 10 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe"C:\Users\Admin\AppData\Local\Temp\9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 3482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exeC:\Users\Admin\AppData\Local\Temp\9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 3083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 5803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 6843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 6963⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 8163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 8523⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 8883⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 12083⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/192-85-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-65-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-64-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-63-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-58-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-59-0x0000000005290000-0x0000000005291000-memory.dmp
memory/192-61-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-60-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-70-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-69-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-68-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-67-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-96-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-89-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-95-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-94-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-92-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-93-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-66-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-91-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-90-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-74-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-88-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-87-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-49-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/192-86-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-62-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-84-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-48-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/192-71-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-83-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-81-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-82-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-80-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-79-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-78-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-77-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-72-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-76-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-75-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/192-73-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/696-9-0x0000000005540000-0x0000000005541000-memory.dmp
memory/696-4-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/752-151-0x0000000005170000-0x0000000005171000-memory.dmp
memory/752-140-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/1328-27-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/1328-21-0x0000000004490000-0x0000000004491000-memory.dmp
memory/1932-1-0x0000000005160000-0x0000000005161000-memory.dmp
memory/1932-0-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/2240-104-0x0000000004120000-0x0000000004121000-memory.dmp
memory/2240-113-0x0000000004930000-0x0000000004931000-memory.dmp
memory/2244-131-0x00000000055E0000-0x00000000055E1000-memory.dmp
memory/2244-121-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
memory/2284-12-0x0000000004620000-0x0000000004621000-memory.dmp
memory/2596-32-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/2596-33-0x0000000004F70000-0x0000000004F71000-memory.dmp