Analysis
- max time kernel
69s - max time network
129s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/05/2021, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
5f1fd29052e8377d5e739cf5adb62735.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5f1fd29052e8377d5e739cf5adb62735.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 5f1fd29052e8377d5e739cf5adb62735.exe
- Size 869KB
- Sample210506-mcdr691wge
- SHA256 17d78ceccf9fd168bf7e1d92260e5369bbd058639587ab92ea78763aafe0e5ee
- MD5 5f1fd29052e8377d5e739cf5adb62735
- SHA1 c5bce621d36cf186d831648e08eb622c61a13a12
- SHA512 4bef4a3957b0cde854f3b09770f6c575e7f99abcfb5560b77b99a45724bf91250f8535a42e54c5a7ebdd64b754de8282b2d9acc1a6a0597920e8d9d93c463e72
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3840 created 796 3840 WerFault.exe 67 - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.2ip.ua 11 api.2ip.ua - Program crash 14 IoCs
pid pid_target Process procid_target 496 796 WerFault.exe 67 3356 796 WerFault.exe 67 3036 796 WerFault.exe 67 2200 796 WerFault.exe 67 1564 796 WerFault.exe 67 2712 796 WerFault.exe 67 1328 796 WerFault.exe 67 2140 796 WerFault.exe 67 1460 796 WerFault.exe 67 992 796 WerFault.exe 67 3972 796 WerFault.exe 67 3148 796 WerFault.exe 67 2292 796 WerFault.exe 67 3840 796 WerFault.exe 67 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 5f1fd29052e8377d5e739cf5adb62735.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 5f1fd29052e8377d5e739cf5adb62735.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3356 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 2200 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeRestorePrivilege 496 WerFault.exe Token: SeBackupPrivilege 496 WerFault.exe Token: SeDebugPrivilege 496 WerFault.exe Token: SeDebugPrivilege 3356 WerFault.exe Token: SeDebugPrivilege 3036 WerFault.exe Token: SeDebugPrivilege 2200 WerFault.exe Token: SeDebugPrivilege 1564 WerFault.exe Token: SeDebugPrivilege 2712 WerFault.exe Token: SeDebugPrivilege 1328 WerFault.exe Token: SeDebugPrivilege 2140 WerFault.exe Token: SeDebugPrivilege 1460 WerFault.exe Token: SeDebugPrivilege 992 WerFault.exe Token: SeDebugPrivilege 3972 WerFault.exe Token: SeDebugPrivilege 3148 WerFault.exe Token: SeDebugPrivilege 2292 WerFault.exe Token: SeDebugPrivilege 3840 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1fd29052e8377d5e739cf5adb62735.exe"C:\Users\Admin\AppData\Local\Temp\5f1fd29052e8377d5e739cf5adb62735.exe"1⤵
- Modifies system certificate store
PID:796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 8242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 8922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 9202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 10322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 11322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 11002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 14362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 16762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 14602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 16842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 16202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 11002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 17202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 8922⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3840
-