Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09-05-2021 22:38
Static task
static1
Behavioral task
behavioral1
Sample
dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe
Resource
win10v20210408
General
-
Target
dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe
-
Size
136KB
-
MD5
faba908f3d962f72a9b4d6cae9bf762c
-
SHA1
a80e57f10fcf285616f10b391e8719724f520cf3
-
SHA256
dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db
-
SHA512
a352593d471b822949220b269db76610b453d680dc36779c534767e34db8aed4d4bddeaa192db7423dbc58ff1562c556b0d59672882a0040fae4eca7b41b327c
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\63AF0DCB = "C:\\Users\\Admin\\AppData\\Roaming\\63AF0DCB\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exedescription pid process target process PID 1032 set thread context of 2968 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2876 3804 WerFault.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exewinver.exeWerFault.exepid process 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe 904 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2740 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
WerFault.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2876 WerFault.exe Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 904 winver.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exepid process 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2740 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exedbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exewinver.exedescription pid process target process PID 1032 wrote to memory of 2968 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe PID 1032 wrote to memory of 2968 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe PID 1032 wrote to memory of 2968 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe PID 1032 wrote to memory of 2968 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe PID 1032 wrote to memory of 2968 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe PID 1032 wrote to memory of 2968 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe PID 1032 wrote to memory of 2968 1032 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe PID 2968 wrote to memory of 904 2968 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe winver.exe PID 2968 wrote to memory of 904 2968 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe winver.exe PID 2968 wrote to memory of 904 2968 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe winver.exe PID 2968 wrote to memory of 904 2968 dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe winver.exe PID 904 wrote to memory of 2740 904 winver.exe Explorer.EXE PID 904 wrote to memory of 2340 904 winver.exe sihost.exe PID 904 wrote to memory of 2348 904 winver.exe svchost.exe PID 904 wrote to memory of 2460 904 winver.exe taskhostw.exe PID 904 wrote to memory of 2740 904 winver.exe Explorer.EXE PID 904 wrote to memory of 3248 904 winver.exe ShellExperienceHost.exe PID 904 wrote to memory of 3264 904 winver.exe SearchUI.exe PID 904 wrote to memory of 3488 904 winver.exe RuntimeBroker.exe PID 904 wrote to memory of 3804 904 winver.exe DllHost.exe PID 904 wrote to memory of 3184 904 winver.exe DllHost.exe PID 904 wrote to memory of 3816 904 winver.exe PID 904 wrote to memory of 2876 904 winver.exe WerFault.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3804 -s 8362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe"C:\Users\Admin\AppData\Local\Temp\dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exeC:\Users\Admin\AppData\Local\Temp\dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-120-0x0000000000BA0000-0x0000000000CEA000-memory.dmpFilesize
1.3MB
-
memory/904-127-0x0000000002DE0000-0x0000000002DE6000-memory.dmpFilesize
24KB
-
memory/904-117-0x0000000000000000-mapping.dmp
-
memory/1032-114-0x0000000000730000-0x0000000000734000-memory.dmpFilesize
16KB
-
memory/2340-122-0x0000000000460000-0x0000000000466000-memory.dmpFilesize
24KB
-
memory/2348-124-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/2460-128-0x0000000000960000-0x0000000000966000-memory.dmpFilesize
24KB
-
memory/2740-121-0x00000000010F0000-0x00000000010F6000-memory.dmpFilesize
24KB
-
memory/2740-123-0x0000000001100000-0x0000000001106000-memory.dmpFilesize
24KB
-
memory/2740-129-0x00007FFC7B040000-0x00007FFC7B041000-memory.dmpFilesize
4KB
-
memory/2968-119-0x00000000017A0000-0x00000000021A0000-memory.dmpFilesize
10.0MB
-
memory/2968-118-0x0000000000400000-0x0000000000404400-memory.dmpFilesize
17KB
-
memory/2968-116-0x0000000000401000-mapping.dmp
-
memory/2968-115-0x0000000000400000-0x000000000149A000-memory.dmpFilesize
16.6MB
-
memory/3184-126-0x0000000000110000-0x0000000000116000-memory.dmpFilesize
24KB
-
memory/3488-125-0x0000000000480000-0x0000000000486000-memory.dmpFilesize
24KB