Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 02:35
Static task
static1
Behavioral task
behavioral1
Sample
f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe
Resource
win10v20210408
General
-
Target
f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe
-
Size
204KB
-
MD5
b8eb55d872e3a6dd64af68af074a0bad
-
SHA1
92fb042b52a0781110cd32eb959e2f5da1e36102
-
SHA256
f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787
-
SHA512
057b7a4f3bec6d33530004c78d7e26fc79ee6cc7e7cfb08a15ee7b2f903d87f82d19f8638850932c1b09e7045b60495cc63b69a1c8a2f7139f93bbae4c7d28b7
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\74D34E6D = "C:\\Users\\Admin\\AppData\\Roaming\\74D34E6D\\bin.exe" winver.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 204 3720 WerFault.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exeWerFault.exepid process 60 winver.exe 60 winver.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe 60 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
Explorer.EXEWerFault.exedescription pid process Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeDebugPrivilege 204 WerFault.exe Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
winver.exeExplorer.EXEpid process 60 winver.exe 8 Explorer.EXE 8 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE 8 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exewinver.exedescription pid process target process PID 896 wrote to memory of 60 896 f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe winver.exe PID 896 wrote to memory of 60 896 f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe winver.exe PID 896 wrote to memory of 60 896 f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe winver.exe PID 896 wrote to memory of 60 896 f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe winver.exe PID 60 wrote to memory of 8 60 winver.exe Explorer.EXE PID 60 wrote to memory of 2344 60 winver.exe sihost.exe PID 60 wrote to memory of 2376 60 winver.exe svchost.exe PID 60 wrote to memory of 2716 60 winver.exe taskhostw.exe PID 60 wrote to memory of 8 60 winver.exe Explorer.EXE PID 60 wrote to memory of 3248 60 winver.exe ShellExperienceHost.exe PID 60 wrote to memory of 3256 60 winver.exe SearchUI.exe PID 60 wrote to memory of 3456 60 winver.exe RuntimeBroker.exe PID 60 wrote to memory of 3720 60 winver.exe DllHost.exe PID 60 wrote to memory of 896 60 winver.exe f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe PID 60 wrote to memory of 2588 60 winver.exe DllHost.exe PID 60 wrote to memory of 2868 60 winver.exe PID 60 wrote to memory of 1500 60 winver.exe slui.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2344
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2376
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3248
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3720
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3720 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:204
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3456
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3256
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:8 -
C:\Users\Admin\AppData\Local\Temp\f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe"C:\Users\Admin\AppData\Local\Temp\f0651ddfc0e0f71cd0c77e82bc63f86a5253385c06ecd390c400bd1770e21787.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:60
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2716
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2588
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵PID:1500
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/8-118-0x00000000006E0000-0x00000000006E6000-memory.dmpFilesize
24KB
-
memory/8-127-0x00007FFD6AF40000-0x00007FFD6AF41000-memory.dmpFilesize
4KB
-
memory/8-120-0x0000000000500000-0x0000000000506000-memory.dmpFilesize
24KB
-
memory/8-119-0x00007FFD6AF30000-0x00007FFD6AF31000-memory.dmpFilesize
4KB
-
memory/60-117-0x0000000002500000-0x000000000264A000-memory.dmpFilesize
1.3MB
-
memory/60-116-0x0000000000000000-mapping.dmp
-
memory/60-126-0x0000000004010000-0x0000000004016000-memory.dmpFilesize
24KB
-
memory/896-114-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/896-115-0x0000000002570000-0x0000000002F70000-memory.dmpFilesize
10.0MB
-
memory/2344-122-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/2376-121-0x0000000000950000-0x0000000000956000-memory.dmpFilesize
24KB
-
memory/2588-125-0x0000000000770000-0x0000000000776000-memory.dmpFilesize
24KB
-
memory/2716-123-0x0000000000A10000-0x0000000000A16000-memory.dmpFilesize
24KB
-
memory/3456-124-0x0000000000E50000-0x0000000000E56000-memory.dmpFilesize
24KB