Analysis
- max time kernel
123s - max time network
141s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/05/2021, 12:03
Static task
static1
Behavioral task
behavioral1
Sample
build.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target build.exe
- Size 869KB
- Sample210506-bpgbqzda26
- SHA256 cb69509065e372794a18a74fa502f7bca8fa6e4be5a0fdb09c4c13dcceb364b6
- MD5 6906c850ebd394462a2b09d1a0d52755
- SHA1 0c303f481aed2d539c5d18e0bff5571b9599a2ac
- SHA512 7c2f70f68f55f060c9aa860194bf9e01d549894b34a52212f7546f50595d2ffc1cf412dc0d8de344d7db02dd1b9d98c806117752e0089ee03da3f0893851e4d0
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 api.2ip.ua 12 api.2ip.ua - Program crash 4 IoCs
pid pid_target Process procid_target 3256 4436 WerFault.exe 68 3924 4436 WerFault.exe 68 1832 4436 WerFault.exe 68 1016 4436 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1832 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 3256 WerFault.exe Token: SeBackupPrivilege 3256 WerFault.exe Token: SeDebugPrivilege 3256 WerFault.exe Token: SeDebugPrivilege 3924 WerFault.exe Token: SeDebugPrivilege 1832 WerFault.exe Token: SeDebugPrivilege 1016 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵PID:4436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 9722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 10522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016
-