Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
08-05-2021 20:01
Static task
static1
Behavioral task
behavioral1
Sample
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe
Resource
win10v20210408
General
-
Target
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe
-
Size
136KB
-
MD5
a3b4abc2087d56e6fd7fb3cbcd4a70f8
-
SHA1
374218547142df2072290c5916c7e7641c9697ae
-
SHA256
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959
-
SHA512
d77d767ef0ef449ced7ade15d601ef73fbcdeb1cdad28a0ef8aa7e608e2e2e8597192f413abda4ab4aabe0b0ef147fd644062da831f0ce3c5499e2f4af6d47f0
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\23A07670 = "C:\\Users\\Admin\\AppData\\Roaming\\23A07670\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exedescription pid process target process PID 644 set thread context of 3192 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1940 3744 WerFault.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exewinver.exeWerFault.exepid process 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 1940 WerFault.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe 2224 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2568 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
WerFault.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1940 WerFault.exe Token: SeShutdownPrivilege 2568 Explorer.EXE Token: SeCreatePagefilePrivilege 2568 Explorer.EXE Token: SeShutdownPrivilege 2568 Explorer.EXE Token: SeCreatePagefilePrivilege 2568 Explorer.EXE Token: SeShutdownPrivilege 2568 Explorer.EXE Token: SeCreatePagefilePrivilege 2568 Explorer.EXE Token: SeShutdownPrivilege 2568 Explorer.EXE Token: SeCreatePagefilePrivilege 2568 Explorer.EXE Token: SeShutdownPrivilege 2568 Explorer.EXE Token: SeCreatePagefilePrivilege 2568 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2224 winver.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exepid process 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2568 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exebeaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exewinver.exedescription pid process target process PID 644 wrote to memory of 3192 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 644 wrote to memory of 3192 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 644 wrote to memory of 3192 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 644 wrote to memory of 3192 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 644 wrote to memory of 3192 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 644 wrote to memory of 3192 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 644 wrote to memory of 3192 644 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 3192 wrote to memory of 2224 3192 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 3192 wrote to memory of 2224 3192 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 3192 wrote to memory of 2224 3192 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 3192 wrote to memory of 2224 3192 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 2224 wrote to memory of 2568 2224 winver.exe Explorer.EXE PID 2224 wrote to memory of 2336 2224 winver.exe sihost.exe PID 2224 wrote to memory of 2356 2224 winver.exe svchost.exe PID 2224 wrote to memory of 2460 2224 winver.exe taskhostw.exe PID 2224 wrote to memory of 2568 2224 winver.exe Explorer.EXE PID 2224 wrote to memory of 3248 2224 winver.exe ShellExperienceHost.exe PID 2224 wrote to memory of 3256 2224 winver.exe SearchUI.exe PID 2224 wrote to memory of 3484 2224 winver.exe RuntimeBroker.exe PID 2224 wrote to memory of 3744 2224 winver.exe DllHost.exe PID 2224 wrote to memory of 2268 2224 winver.exe DllHost.exe PID 2224 wrote to memory of 3576 2224 winver.exe PID 2224 wrote to memory of 1940 2224 winver.exe WerFault.exe PID 2224 wrote to memory of 4068 2224 winver.exe slui.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3744 -s 8362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe"C:\Users\Admin\AppData\Local\Temp\beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exeC:\Users\Admin\AppData\Local\Temp\beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/644-114-0x0000000000AA0000-0x0000000000AA4000-memory.dmpFilesize
16KB
-
memory/1940-130-0x00007FFBBC480000-0x00007FFBBC481000-memory.dmpFilesize
4KB
-
memory/2224-117-0x0000000000000000-mapping.dmp
-
memory/2224-128-0x0000000000FA0000-0x0000000000FA6000-memory.dmpFilesize
24KB
-
memory/2224-120-0x0000000000800000-0x000000000094A000-memory.dmpFilesize
1.3MB
-
memory/2268-123-0x00000000009F0000-0x00000000009F6000-memory.dmpFilesize
24KB
-
memory/2336-126-0x0000000000F00000-0x0000000000F06000-memory.dmpFilesize
24KB
-
memory/2356-125-0x0000000000AF0000-0x0000000000AF6000-memory.dmpFilesize
24KB
-
memory/2460-127-0x00000000004A0000-0x00000000004A6000-memory.dmpFilesize
24KB
-
memory/2568-131-0x00007FFBBC490000-0x00007FFBBC491000-memory.dmpFilesize
4KB
-
memory/2568-121-0x0000000000CD0000-0x0000000000CD6000-memory.dmpFilesize
24KB
-
memory/2568-124-0x0000000000CC0000-0x0000000000CC6000-memory.dmpFilesize
24KB
-
memory/3192-118-0x0000000000400000-0x0000000000404400-memory.dmpFilesize
17KB
-
memory/3192-119-0x0000000001730000-0x0000000002130000-memory.dmpFilesize
10.0MB
-
memory/3192-116-0x0000000000401000-mapping.dmp
-
memory/3192-115-0x0000000000400000-0x000000000149A000-memory.dmpFilesize
16.6MB
-
memory/3484-122-0x00000000000D0000-0x00000000000D6000-memory.dmpFilesize
24KB
-
memory/4068-132-0x00000000004F0000-0x00000000004F6000-memory.dmpFilesize
24KB