Analysis
-
max time kernel
65s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 03:03
Static task
static1
Behavioral task
behavioral1
Sample
caa228a52c5fed860f611652f35cec2f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
caa228a52c5fed860f611652f35cec2f.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
caa228a52c5fed860f611652f35cec2f.exe
-
Size
831KB
-
MD5
caa228a52c5fed860f611652f35cec2f
-
SHA1
25c1c4fedb3699e34f1a72829d41bfa545a604f5
-
SHA256
ec6a8a30d1d66e885ef75aaf70786fb1c05ccb1ae252c918a62a882a3babf591
-
SHA512
af1e1eab52199e38f13a0154a959f2726311dcd99319608391bb5b42b05565074c54daf9ccdf2ffbc35db68092cf4243caff9dc2abfd60ec4ed1d0c4bd446519
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 208 created 4008 208 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 api.2ip.ua 12 api.2ip.ua -
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4016 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 188 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 772 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 3120 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 372 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 3196 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 1340 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 3364 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 2420 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 3964 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 2736 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 2768 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 4088 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe 208 4008 WerFault.exe caa228a52c5fed860f611652f35cec2f.exe -
Processes:
caa228a52c5fed860f611652f35cec2f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 caa228a52c5fed860f611652f35cec2f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e caa228a52c5fed860f611652f35cec2f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 3120 WerFault.exe 372 WerFault.exe 372 WerFault.exe 372 WerFault.exe 372 WerFault.exe 372 WerFault.exe 372 WerFault.exe 372 WerFault.exe 372 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 4016 WerFault.exe Token: SeBackupPrivilege 4016 WerFault.exe Token: SeDebugPrivilege 4016 WerFault.exe Token: SeDebugPrivilege 188 WerFault.exe Token: SeDebugPrivilege 772 WerFault.exe Token: SeDebugPrivilege 3120 WerFault.exe Token: SeDebugPrivilege 372 WerFault.exe Token: SeDebugPrivilege 3196 WerFault.exe Token: SeDebugPrivilege 1340 WerFault.exe Token: SeDebugPrivilege 3364 WerFault.exe Token: SeDebugPrivilege 2420 WerFault.exe Token: SeDebugPrivilege 3964 WerFault.exe Token: SeDebugPrivilege 2736 WerFault.exe Token: SeDebugPrivilege 2768 WerFault.exe Token: SeDebugPrivilege 4088 WerFault.exe Token: SeDebugPrivilege 208 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\caa228a52c5fed860f611652f35cec2f.exe"C:\Users\Admin\AppData\Local\Temp\caa228a52c5fed860f611652f35cec2f.exe"1⤵
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 8642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 8722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 9282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 11162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 11562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 11282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 14402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 14762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 16762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 15042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 16642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 16002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 14682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 8362⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken