Analysis
-
max time kernel
13s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30-03-2021 01:26
Behavioral task
behavioral1
Sample
F7B9980B8346B59F0B012E07F0D2207C.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
F7B9980B8346B59F0B012E07F0D2207C.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
F7B9980B8346B59F0B012E07F0D2207C.exe
-
Size
277KB
-
MD5
f7b9980b8346b59f0b012e07f0d2207c
-
SHA1
eaf80f0dcaea152d4bd81eeaa3ff8d31330acd01
-
SHA256
2edc1d26a755fce3c36d97ee664473a24c09f653c38792118db34196cd638d06
-
SHA512
5c26b7a32039b95c3a58e73e6ba1e0975758937a46fcf8b36dd34651fb2a5e035671ed05a6651139f500a6a0ba95216cc22dafb799a3c1470238266f1eccc497
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run F7B9980B8346B59F0B012E07F0D2207C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Microsoft\\explorer.exe" F7B9980B8346B59F0B012E07F0D2207C.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run F7B9980B8346B59F0B012E07F0D2207C.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Microsoft\\explorer.exe" F7B9980B8346B59F0B012E07F0D2207C.exe -
Modifies Installed Components in the registry 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run F7B9980B8346B59F0B012E07F0D2207C.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Microsoft\\explorer.exe" F7B9980B8346B59F0B012E07F0D2207C.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run F7B9980B8346B59F0B012E07F0D2207C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Microsoft\\explorer.exe" F7B9980B8346B59F0B012E07F0D2207C.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft\explorer.exe F7B9980B8346B59F0B012E07F0D2207C.exe File opened for modification C:\Windows\Microsoft\explorer.exe F7B9980B8346B59F0B012E07F0D2207C.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3940 2740 WerFault.exe 75 -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3940 WerFault.exe Token: SeBackupPrivilege 3940 WerFault.exe Token: SeDebugPrivilege 3940 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75 PID 3996 wrote to memory of 2740 3996 F7B9980B8346B59F0B012E07F0D2207C.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\F7B9980B8346B59F0B012E07F0D2207C.exe"C:\Users\Admin\AppData\Local\Temp\F7B9980B8346B59F0B012E07F0D2207C.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe"2⤵PID:2740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 7163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-