Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
08-05-2021 22:50
Static task
static1
Behavioral task
behavioral1
Sample
30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe
Resource
win10v20210410
General
-
Target
30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe
-
Size
136KB
-
MD5
be4e939fcbe12530872d5fc913d851fa
-
SHA1
7493ee4fd5bb99ec93e4501b68e5506c95d9aa31
-
SHA256
30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7
-
SHA512
8117305e7ba00de35abac6e540ba3b184f03c56e20a8a728e7f21ed443f65e5e9be12a37ce84913832fc99f4b5196dfd74ad2050a58613651d0847c08dae1bae
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\CF6E22A8 = "C:\\Users\\Admin\\AppData\\Roaming\\CF6E22A8\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exedescription pid process target process PID 3736 set thread context of 3060 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2736 3728 WerFault.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exewinver.exeWerFault.exepid process 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 3456 winver.exe 3456 winver.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe 3456 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
Explorer.EXEWerFault.exedescription pid process Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeDebugPrivilege 2736 WerFault.exe Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
winver.exeExplorer.EXEpid process 3456 winver.exe 3052 Explorer.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exepid process 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exewinver.exedescription pid process target process PID 3736 wrote to memory of 3060 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe PID 3736 wrote to memory of 3060 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe PID 3736 wrote to memory of 3060 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe PID 3736 wrote to memory of 3060 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe PID 3736 wrote to memory of 3060 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe PID 3736 wrote to memory of 3060 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe PID 3736 wrote to memory of 3060 3736 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe PID 3060 wrote to memory of 3456 3060 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe winver.exe PID 3060 wrote to memory of 3456 3060 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe winver.exe PID 3060 wrote to memory of 3456 3060 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe winver.exe PID 3060 wrote to memory of 3456 3060 30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe winver.exe PID 3456 wrote to memory of 3052 3456 winver.exe Explorer.EXE PID 3456 wrote to memory of 2424 3456 winver.exe sihost.exe PID 3456 wrote to memory of 2464 3456 winver.exe svchost.exe PID 3456 wrote to memory of 2744 3456 winver.exe taskhostw.exe PID 3456 wrote to memory of 3052 3456 winver.exe Explorer.EXE PID 3456 wrote to memory of 3260 3456 winver.exe ShellExperienceHost.exe PID 3456 wrote to memory of 3276 3456 winver.exe SearchUI.exe PID 3456 wrote to memory of 3464 3456 winver.exe RuntimeBroker.exe PID 3456 wrote to memory of 3728 3456 winver.exe DllHost.exe PID 3456 wrote to memory of 284 3456 winver.exe DllHost.exe PID 3456 wrote to memory of 2416 3456 winver.exe PID 3456 wrote to memory of 2736 3456 winver.exe WerFault.exe PID 3456 wrote to memory of 3844 3456 winver.exe slui.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3728 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe"C:\Users\Admin\AppData\Local\Temp\30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exeC:\Users\Admin\AppData\Local\Temp\30d0a7713a2cbd7751853519f876d1b0918319463a6c2cfdfd3966a243ee97c7.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/284-128-0x0000000000110000-0x0000000000116000-memory.dmpFilesize
24KB
-
memory/2424-124-0x0000000000FB0000-0x0000000000FB6000-memory.dmpFilesize
24KB
-
memory/2464-125-0x00000000000A0000-0x00000000000A6000-memory.dmpFilesize
24KB
-
memory/2736-131-0x00007FF9F8920000-0x00007FF9F8921000-memory.dmpFilesize
4KB
-
memory/2744-126-0x0000000000790000-0x0000000000796000-memory.dmpFilesize
24KB
-
memory/3052-122-0x00007FF9F8920000-0x00007FF9F8921000-memory.dmpFilesize
4KB
-
memory/3052-123-0x0000000000AF0000-0x0000000000AF6000-memory.dmpFilesize
24KB
-
memory/3052-121-0x0000000000AE0000-0x0000000000AE6000-memory.dmpFilesize
24KB
-
memory/3052-132-0x00007FF9F8930000-0x00007FF9F8931000-memory.dmpFilesize
4KB
-
memory/3060-118-0x0000000000400000-0x0000000000404400-memory.dmpFilesize
17KB
-
memory/3060-119-0x0000000001740000-0x0000000002140000-memory.dmpFilesize
10.0MB
-
memory/3060-115-0x0000000000401000-mapping.dmp
-
memory/3060-114-0x0000000000400000-0x000000000149A000-memory.dmpFilesize
16.6MB
-
memory/3456-120-0x0000000002800000-0x000000000294A000-memory.dmpFilesize
1.3MB
-
memory/3456-116-0x0000000000000000-mapping.dmp
-
memory/3456-129-0x0000000004340000-0x0000000004346000-memory.dmpFilesize
24KB
-
memory/3464-127-0x00000000000F0000-0x00000000000F6000-memory.dmpFilesize
24KB
-
memory/3736-117-0x0000000000640000-0x0000000000644000-memory.dmpFilesize
16KB
-
memory/3844-133-0x0000000000BC0000-0x0000000000BC6000-memory.dmpFilesize
24KB