Analysis
- max time kernel
146s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/11/2020, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe
- Size 1.0MB
- Sample201108-m372jfc2fe
- SHA256 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398
- MD5 f51fa43a7f3f23279f7eedb8f9cf53dc
- SHA1 aebe8f8b4fdfc7fc851a2853b0174a1f7e9bffe8
- SHA512 f5848f698ba1816ec0112a67a8dbc0e62b7e5bd12c72ba084905388e3eaff8dbf2ec72d1912ed636061c44d65ec363d7be07fd0179dd51dbeb0792a417ade70b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3792 created 3884 3792 WerFault.exe 92 - Executes dropped EXE 1 IoCs
pid Process 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Modifies Installed Components in the registry 2 TTPs
- Deletes itself 1 IoCs
pid Process 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\trkcore = "C:\\ProgramData\\Microsoft\\Roaming\\svchost.exe" ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Program crash 10 IoCs
pid pid_target Process procid_target 1232 744 WerFault.exe 68 3736 2032 WerFault.exe 78 200 2032 WerFault.exe 78 1312 2032 WerFault.exe 78 504 2032 WerFault.exe 78 2464 2032 WerFault.exe 78 3968 2032 WerFault.exe 78 2816 2032 WerFault.exe 78 1124 2032 WerFault.exe 78 3792 3884 WerFault.exe 92 - Modifies registry class 6 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe - Suspicious behavior: EnumeratesProcesses 161 IoCs
pid Process 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 1232 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 504 WerFault.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 744 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeRestorePrivilege 1232 WerFault.exe Token: SeBackupPrivilege 1232 WerFault.exe Token: SeDebugPrivilege 1232 WerFault.exe Token: SeDebugPrivilege 3736 WerFault.exe Token: SeDebugPrivilege 200 WerFault.exe Token: SeDebugPrivilege 1312 WerFault.exe Token: SeDebugPrivilege 504 WerFault.exe Token: SeDebugPrivilege 2464 WerFault.exe Token: SeDebugPrivilege 3968 WerFault.exe Token: SeDebugPrivilege 2816 WerFault.exe Token: SeDebugPrivilege 1124 WerFault.exe Token: SeShutdownPrivilege 3884 explorer.exe Token: SeCreatePagefilePrivilege 3884 explorer.exe Token: SeShutdownPrivilege 3884 explorer.exe Token: SeCreatePagefilePrivilege 3884 explorer.exe Token: SeShutdownPrivilege 3884 explorer.exe Token: SeCreatePagefilePrivilege 3884 explorer.exe Token: SeShutdownPrivilege 3884 explorer.exe Token: SeCreatePagefilePrivilege 3884 explorer.exe Token: SeShutdownPrivilege 3884 explorer.exe Token: SeCreatePagefilePrivilege 3884 explorer.exe Token: SeShutdownPrivilege 3884 explorer.exe Token: SeCreatePagefilePrivilege 3884 explorer.exe Token: SeDebugPrivilege 3792 WerFault.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1000 sihost.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe - Suspicious use of SendNotifyMessage 9 IoCs
pid Process 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe 3884 explorer.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2032 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 744 wrote to memory of 2032 744 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 78 PID 744 wrote to memory of 2032 744 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 78 PID 744 wrote to memory of 2032 744 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 78 PID 1000 wrote to memory of 1244 1000 sihost.exe 96 PID 1000 wrote to memory of 1244 1000 sihost.exe 96 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe"C:\Users\Admin\AppData\Local\Temp\ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 3402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Users\Admin\AppData\Local\Temp\ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exeC:\Users\Admin\AppData\Local\Temp\ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
PID:2032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 3083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 5803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 6843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 8123⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 7923⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 8523⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 9363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 11723⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies registry class
PID:1244
-
-
\??\c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2440
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3884 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3884 -s 22402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2820
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵PID:1532
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:2888