Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 16:49
Static task
static1
Behavioral task
behavioral1
Sample
36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe
Resource
win10v20210410
General
-
Target
36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe
-
Size
60KB
-
MD5
329322e92f4cbc709e617861f603012c
-
SHA1
32cadcb90705cfafdf000380be976af0a30bb9f6
-
SHA256
36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1
-
SHA512
d44d2e63f847b3e6a574468efe3183b4e841b2ea416caa73596cc7af479556776baf22e3d3ec605b999c460a00aba44e5990e27cbe598390c9d2ef20642e8688
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\DA503BDD = "C:\\Users\\Admin\\AppData\\Roaming\\DA503BDD\\bin.exe" winver.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3144 3820 WerFault.exe DllHost.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exeWerFault.exepid process 1212 winver.exe 1212 winver.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe 1212 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
Explorer.EXEWerFault.exedescription pid process Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeDebugPrivilege 3144 WerFault.exe Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 1212 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exewinver.exedescription pid process target process PID 1844 wrote to memory of 1212 1844 36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe winver.exe PID 1844 wrote to memory of 1212 1844 36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe winver.exe PID 1844 wrote to memory of 1212 1844 36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe winver.exe PID 1844 wrote to memory of 1212 1844 36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe winver.exe PID 1212 wrote to memory of 3040 1212 winver.exe Explorer.EXE PID 1212 wrote to memory of 2432 1212 winver.exe sihost.exe PID 1212 wrote to memory of 2480 1212 winver.exe svchost.exe PID 1212 wrote to memory of 2712 1212 winver.exe taskhostw.exe PID 1212 wrote to memory of 3040 1212 winver.exe Explorer.EXE PID 1212 wrote to memory of 3244 1212 winver.exe SearchUI.exe PID 1212 wrote to memory of 3256 1212 winver.exe ShellExperienceHost.exe PID 1212 wrote to memory of 3580 1212 winver.exe RuntimeBroker.exe PID 1212 wrote to memory of 3820 1212 winver.exe DllHost.exe PID 1212 wrote to memory of 2492 1212 winver.exe DllHost.exe PID 1212 wrote to memory of 3992 1212 winver.exe PID 1212 wrote to memory of 3144 1212 winver.exe WerFault.exe PID 1212 wrote to memory of 1300 1212 winver.exe slui.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3820 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe"C:\Users\Admin\AppData\Local\Temp\36a81154582af0b3128c5875c8704e79aa30aad5d09a7b32f28aaacbc43d0fd1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-116-0x0000000000D70000-0x0000000000E1E000-memory.dmpFilesize
696KB
-
memory/1212-114-0x0000000000000000-mapping.dmp
-
memory/1300-129-0x0000000000500000-0x0000000000506000-memory.dmpFilesize
24KB
-
memory/1844-115-0x0000000000540000-0x0000000000542000-memory.dmpFilesize
8KB
-
memory/1844-117-0x0000000002380000-0x0000000002D80000-memory.dmpFilesize
10.0MB
-
memory/2432-122-0x0000000000CA0000-0x0000000000CA6000-memory.dmpFilesize
24KB
-
memory/2480-123-0x0000000000CB0000-0x0000000000CB6000-memory.dmpFilesize
24KB
-
memory/2492-127-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/2712-124-0x00000000005E0000-0x00000000005E6000-memory.dmpFilesize
24KB
-
memory/3040-118-0x0000000001370000-0x0000000001376000-memory.dmpFilesize
24KB
-
memory/3040-121-0x0000000001420000-0x0000000001426000-memory.dmpFilesize
24KB
-
memory/3040-126-0x00007FF89A2E0000-0x00007FF89A2E1000-memory.dmpFilesize
4KB
-
memory/3040-120-0x00007FF89A2D0000-0x00007FF89A2D1000-memory.dmpFilesize
4KB
-
memory/3040-119-0x00007FF89A2F0000-0x00007FF89A2F1000-memory.dmpFilesize
4KB
-
memory/3144-128-0x00000000005B0000-0x00000000005B6000-memory.dmpFilesize
24KB
-
memory/3580-125-0x0000000000480000-0x0000000000486000-memory.dmpFilesize
24KB