Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 16:45
Static task
static1
Behavioral task
behavioral1
Sample
4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe
Resource
win10v20210408
General
-
Target
4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe
-
Size
52KB
-
MD5
3b245280e5b53c01f840d8c839b47e8b
-
SHA1
0b17f102f6c2fb6d0429572d9826f6e549365a6f
-
SHA256
4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650
-
SHA512
3258952cf56e50b6d6a01f68a9ea1bf13ea801035a0aea1cf19313537fb0d385cfee398c50098c79275a506cdeda2a03e08046c8e9b88dfe7b2be183d91a6806
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\D53E36A7 = "C:\\Users\\Admin\\AppData\\Roaming\\D53E36A7\\bin.exe" winver.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 772 3760 WerFault.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exeWerFault.exepid process 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe 3172 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3060 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
Explorer.EXEWerFault.exedescription pid process Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE Token: SeDebugPrivilege 772 WerFault.exe Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 3172 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3060 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exewinver.exedescription pid process target process PID 808 wrote to memory of 3172 808 4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe winver.exe PID 808 wrote to memory of 3172 808 4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe winver.exe PID 808 wrote to memory of 3172 808 4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe winver.exe PID 808 wrote to memory of 3172 808 4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe winver.exe PID 3172 wrote to memory of 3060 3172 winver.exe Explorer.EXE PID 3172 wrote to memory of 2332 3172 winver.exe sihost.exe PID 3172 wrote to memory of 2348 3172 winver.exe svchost.exe PID 3172 wrote to memory of 2748 3172 winver.exe taskhostw.exe PID 3172 wrote to memory of 3060 3172 winver.exe Explorer.EXE PID 3172 wrote to memory of 3264 3172 winver.exe ShellExperienceHost.exe PID 3172 wrote to memory of 3276 3172 winver.exe SearchUI.exe PID 3172 wrote to memory of 3464 3172 winver.exe RuntimeBroker.exe PID 3172 wrote to memory of 3760 3172 winver.exe DllHost.exe PID 3172 wrote to memory of 3624 3172 winver.exe DllHost.exe PID 3172 wrote to memory of 1972 3172 winver.exe PID 3172 wrote to memory of 772 3172 winver.exe WerFault.exe PID 3172 wrote to memory of 3864 3172 winver.exe slui.exe
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3760 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe"C:\Users\Admin\AppData\Local\Temp\4550f60f52e03add64e0f035325604114864a9f33593ab9da47b5179b375b650.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-128-0x00007FFA99460000-0x00007FFA99461000-memory.dmpFilesize
4KB
-
memory/772-129-0x00007FFA99480000-0x00007FFA99481000-memory.dmpFilesize
4KB
-
memory/772-130-0x00007FFA99470000-0x00007FFA99471000-memory.dmpFilesize
4KB
-
memory/772-127-0x00000000006A0000-0x00000000006A6000-memory.dmpFilesize
24KB
-
memory/808-116-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/808-117-0x00000000022A0000-0x0000000002CA0000-memory.dmpFilesize
10.0MB
-
memory/808-114-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2332-121-0x0000000000F50000-0x0000000000F56000-memory.dmpFilesize
24KB
-
memory/2348-123-0x0000000000650000-0x0000000000656000-memory.dmpFilesize
24KB
-
memory/2748-124-0x0000000000320000-0x0000000000326000-memory.dmpFilesize
24KB
-
memory/3060-122-0x0000000001400000-0x0000000001406000-memory.dmpFilesize
24KB
-
memory/3060-120-0x00007FFA99470000-0x00007FFA99471000-memory.dmpFilesize
4KB
-
memory/3060-119-0x0000000001600000-0x0000000001606000-memory.dmpFilesize
24KB
-
memory/3060-131-0x00007FFA99480000-0x00007FFA99481000-memory.dmpFilesize
4KB
-
memory/3172-118-0x0000000002DE0000-0x0000000002F2A000-memory.dmpFilesize
1.3MB
-
memory/3172-115-0x0000000000000000-mapping.dmp
-
memory/3464-125-0x0000000000CE0000-0x0000000000CE6000-memory.dmpFilesize
24KB
-
memory/3624-126-0x0000000000650000-0x0000000000656000-memory.dmpFilesize
24KB
-
memory/3864-132-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB