Analysis
- max time kernel
86s - max time network
142s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
affa8586bb8f072003d20117b614ea37.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
affa8586bb8f072003d20117b614ea37.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target affa8586bb8f072003d20117b614ea37.exe
- Size 758KB
- Sample201109-5phtyyzsf2
- SHA256 8aa7a5eb1247b0d54b2bd29dd6b2d563ca30da4990c8220f61da826fe5941452
- MD5 affa8586bb8f072003d20117b614ea37
- SHA1 7e63b27c4c3f3708bd14aa3e394a074b15b2c8dc
- SHA512 c69530df76261938eb52ae96c0d5471e411722e8a4243bed9a6533a5c784367af1633c52ef6693aa743e14a0767f75679843b0027e5e10e141c320711c1537bc
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3096 created 3224 3096 WerFault.exe 78 - ServiceHost packer 10 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/3224-4-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-5-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-6-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-7-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-9-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-8-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-10-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-11-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-13-0x000000000043F5F5-mapping.dmp servicehost behavioral2/memory/3224-12-0x000000000043F5F5-mapping.dmp servicehost - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4708 set thread context of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 - Program crash 1 IoCs
pid pid_target Process procid_target 3096 3224 WerFault.exe 78 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe 3096 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3096 WerFault.exe Token: SeBackupPrivilege 3096 WerFault.exe Token: SeDebugPrivilege 3096 WerFault.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78 PID 4708 wrote to memory of 3224 4708 affa8586bb8f072003d20117b614ea37.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\affa8586bb8f072003d20117b614ea37.exe"C:\Users\Admin\AppData\Local\Temp\affa8586bb8f072003d20117b614ea37.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\affa8586bb8f072003d20117b614ea37.exe"{path}"2⤵PID:3224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 11083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-