Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
08-05-2021 19:22
Static task
static1
Behavioral task
behavioral1
Sample
b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe
Resource
win10v20210408
General
-
Target
b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe
-
Size
152KB
-
MD5
c4f9a35e5e7b74b08bbf5a60f3041631
-
SHA1
3eb9356324243d6210c08d927ff8711f670246ea
-
SHA256
b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345
-
SHA512
6f39c8eb420843d7c8087b056ec7337e465467fe6cd95f0caf20ece243f5e24d3c7c9de313ef06333485946a92e6c3388f2ea9fe49670cadb978a7a2269d3e20
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\E5BDADBD = "C:\\Users\\Admin\\AppData\\Roaming\\E5BDADBD\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exedescription pid process target process PID 4656 set thread context of 3688 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3940 3840 WerFault.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exewinver.exeWerFault.exepid process 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3940 WerFault.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe 3692 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
WerFault.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3940 WerFault.exe Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 3692 winver.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exepid process 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exeb3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exewinver.exedescription pid process target process PID 4656 wrote to memory of 3688 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe PID 4656 wrote to memory of 3688 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe PID 4656 wrote to memory of 3688 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe PID 4656 wrote to memory of 3688 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe PID 4656 wrote to memory of 3688 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe PID 4656 wrote to memory of 3688 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe PID 4656 wrote to memory of 3688 4656 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe PID 3688 wrote to memory of 3692 3688 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe winver.exe PID 3688 wrote to memory of 3692 3688 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe winver.exe PID 3688 wrote to memory of 3692 3688 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe winver.exe PID 3688 wrote to memory of 3692 3688 b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe winver.exe PID 3692 wrote to memory of 3048 3692 winver.exe Explorer.EXE PID 3692 wrote to memory of 2332 3692 winver.exe sihost.exe PID 3692 wrote to memory of 2352 3692 winver.exe svchost.exe PID 3692 wrote to memory of 2448 3692 winver.exe taskhostw.exe PID 3692 wrote to memory of 3048 3692 winver.exe Explorer.EXE PID 3692 wrote to memory of 3336 3692 winver.exe ShellExperienceHost.exe PID 3692 wrote to memory of 3348 3692 winver.exe SearchUI.exe PID 3692 wrote to memory of 3584 3692 winver.exe RuntimeBroker.exe PID 3692 wrote to memory of 3840 3692 winver.exe DllHost.exe PID 3692 wrote to memory of 5108 3692 winver.exe DllHost.exe PID 3692 wrote to memory of 4272 3692 winver.exe PID 3692 wrote to memory of 3940 3692 winver.exe WerFault.exe PID 3692 wrote to memory of 860 3692 winver.exe slui.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3840 -s 8362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe"C:\Users\Admin\AppData\Local\Temp\b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exeC:\Users\Admin\AppData\Local\Temp\b3b963488acd8e02409dde8b659a8274a50260d24e98f3344161420cc0455345.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/860-131-0x00000000007C0000-0x00000000007C6000-memory.dmpFilesize
24KB
-
memory/2332-122-0x0000000000010000-0x0000000000016000-memory.dmpFilesize
24KB
-
memory/2352-125-0x0000000000F50000-0x0000000000F56000-memory.dmpFilesize
24KB
-
memory/2448-124-0x0000000000DB0000-0x0000000000DB6000-memory.dmpFilesize
24KB
-
memory/3048-129-0x00007FFA78680000-0x00007FFA78681000-memory.dmpFilesize
4KB
-
memory/3048-123-0x0000000000AD0000-0x0000000000AD6000-memory.dmpFilesize
24KB
-
memory/3048-121-0x0000000000AC0000-0x0000000000AC6000-memory.dmpFilesize
24KB
-
memory/3584-126-0x0000000000C30000-0x0000000000C36000-memory.dmpFilesize
24KB
-
memory/3688-117-0x0000000000400000-0x0000000000404400-memory.dmpFilesize
17KB
-
memory/3688-118-0x0000000001760000-0x0000000002160000-memory.dmpFilesize
10.0MB
-
memory/3688-114-0x0000000000400000-0x000000000149A000-memory.dmpFilesize
16.6MB
-
memory/3688-115-0x0000000000401000-mapping.dmp
-
memory/3692-120-0x0000000000AC0000-0x0000000000AC6000-memory.dmpFilesize
24KB
-
memory/3692-119-0x0000000000000000-mapping.dmp
-
memory/3692-128-0x0000000000CC0000-0x0000000000CC6000-memory.dmpFilesize
24KB
-
memory/4656-116-0x0000000002240000-0x0000000002244000-memory.dmpFilesize
16KB
-
memory/5108-127-0x0000000000EB0000-0x0000000000EB6000-memory.dmpFilesize
24KB