Analysis
-
max time kernel
143s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 14:25
Static task
static1
Behavioral task
behavioral1
Sample
433b76b50aff2852f8e7a5071594df71.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
433b76b50aff2852f8e7a5071594df71.exe
Resource
win10v20201028
General
-
Target
433b76b50aff2852f8e7a5071594df71.exe
-
Size
14.7MB
-
MD5
433b76b50aff2852f8e7a5071594df71
-
SHA1
d721a6ffb0c601d9b7209ce0cf0334d9a70b4810
-
SHA256
289638ff4cfd284afe4780faa40c63f0c484de2eaabe35f006cbfa7f538fe891
-
SHA512
4b99fa41f4e937f109e9b3564146c12ed63bda8e354c2078a0c5d56af9afb611673a586995fb942efe3514c9c278c972c3610488e12410816e894127fcf08f7a
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
wzfzozkq.exepid process 2768 wzfzozkq.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2840 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wzfzozkq.exedescription pid process target process PID 2768 set thread context of 2840 2768 wzfzozkq.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Program crash 19 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2960 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 4084 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 2920 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 1276 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 700 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 2640 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 740 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 4076 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 2176 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 4060 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 1752 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 2576 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 4044 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 2688 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 3256 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 2244 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 3120 3084 WerFault.exe 433b76b50aff2852f8e7a5071594df71.exe 4040 2768 WerFault.exe wzfzozkq.exe 3204 2768 WerFault.exe wzfzozkq.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
433b76b50aff2852f8e7a5071594df71.exewzfzozkq.exedescription pid process target process PID 3084 wrote to memory of 2756 3084 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 3084 wrote to memory of 2756 3084 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 3084 wrote to memory of 2756 3084 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 3084 wrote to memory of 2156 3084 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 3084 wrote to memory of 2156 3084 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 3084 wrote to memory of 2156 3084 433b76b50aff2852f8e7a5071594df71.exe cmd.exe PID 3084 wrote to memory of 1852 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 1852 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 1852 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 3520 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 3520 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 3520 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 940 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 940 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 940 3084 433b76b50aff2852f8e7a5071594df71.exe sc.exe PID 3084 wrote to memory of 2180 3084 433b76b50aff2852f8e7a5071594df71.exe netsh.exe PID 3084 wrote to memory of 2180 3084 433b76b50aff2852f8e7a5071594df71.exe netsh.exe PID 3084 wrote to memory of 2180 3084 433b76b50aff2852f8e7a5071594df71.exe netsh.exe PID 2768 wrote to memory of 2840 2768 wzfzozkq.exe svchost.exe PID 2768 wrote to memory of 2840 2768 wzfzozkq.exe svchost.exe PID 2768 wrote to memory of 2840 2768 wzfzozkq.exe svchost.exe PID 2768 wrote to memory of 2840 2768 wzfzozkq.exe svchost.exe PID 2768 wrote to memory of 2840 2768 wzfzozkq.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe"C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 5682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 5722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 6802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 9522⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bnrsamsr\2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 8362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 7002⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wzfzozkq.exe" C:\Windows\SysWOW64\bnrsamsr\2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 6922⤵
- Program crash
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create bnrsamsr binPath= "C:\Windows\SysWOW64\bnrsamsr\wzfzozkq.exe /d\"C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 7322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description bnrsamsr "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 10202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start bnrsamsr2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 6882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 5202⤵
- Program crash
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\bnrsamsr\wzfzozkq.exeC:\Windows\SysWOW64\bnrsamsr\wzfzozkq.exe /d"C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 5882⤵
- Program crash
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 5882⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wzfzozkq.exeMD5
71364dc3f1f4fd4b258ea39541264638
SHA19a34a0a6d68d2ffbd48deacd08888176d17559ee
SHA2566b6c6f21b3848190649db21e372769b6523ff1e514ee6c14cee78620f5b7392d
SHA5127450a2566697435aca2b2c5622923dfa3a7a73a1ea40d73b9cda4f0ff1c543c6b658dfdc99aa1be98f73cef779ed905a23c8855d23959ac807c40b39edbc4783
-
C:\Windows\SysWOW64\bnrsamsr\wzfzozkq.exeMD5
71364dc3f1f4fd4b258ea39541264638
SHA19a34a0a6d68d2ffbd48deacd08888176d17559ee
SHA2566b6c6f21b3848190649db21e372769b6523ff1e514ee6c14cee78620f5b7392d
SHA5127450a2566697435aca2b2c5622923dfa3a7a73a1ea40d73b9cda4f0ff1c543c6b658dfdc99aa1be98f73cef779ed905a23c8855d23959ac807c40b39edbc4783
-
memory/940-20-0x0000000000000000-mapping.dmp
-
memory/1852-18-0x0000000000000000-mapping.dmp
-
memory/2156-16-0x0000000000000000-mapping.dmp
-
memory/2180-24-0x0000000000000000-mapping.dmp
-
memory/2756-15-0x0000000000000000-mapping.dmp
-
memory/2768-23-0x00000000015C0000-0x00000000015C1000-memory.dmpFilesize
4KB
-
memory/2840-26-0x0000000000A39A6B-mapping.dmp
-
memory/2840-25-0x0000000000A30000-0x0000000000A45000-memory.dmpFilesize
84KB
-
memory/3084-9-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/3084-11-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/3084-10-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/3084-12-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/3084-8-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/3084-7-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/3084-3-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/3084-2-0x0000000000E56000-0x0000000000E57000-memory.dmpFilesize
4KB
-
memory/3084-14-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/3084-13-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/3520-19-0x0000000000000000-mapping.dmp