Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 02:08
Static task
static1
Behavioral task
behavioral1
Sample
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe
Resource
win10v20210410
General
-
Target
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe
-
Size
152KB
-
MD5
bdf959504b5f4c4200e834929244b77b
-
SHA1
5e802ffa9f31ed6eb20d0ead8795394b3003ff8c
-
SHA256
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8
-
SHA512
028ea7463870901f73cb012dfc8210e567395dc3845f1952dbe41fc975157e3d24e8cbbc621b04c00361245181f10fe409a12b8c9979808b34a3026cbccff552
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\8D2C0D14 = "C:\\Users\\Admin\\AppData\\Roaming\\8D2C0D14\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exedescription pid process target process PID 4008 set thread context of 3700 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2144 3872 WerFault.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exeWerFault.exepid process 1512 winver.exe 1512 winver.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe 1512 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1700 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
WerFault.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2144 WerFault.exe Token: SeShutdownPrivilege 1700 Explorer.EXE Token: SeCreatePagefilePrivilege 1700 Explorer.EXE Token: SeShutdownPrivilege 1700 Explorer.EXE Token: SeCreatePagefilePrivilege 1700 Explorer.EXE Token: SeShutdownPrivilege 1700 Explorer.EXE Token: SeCreatePagefilePrivilege 1700 Explorer.EXE Token: SeShutdownPrivilege 1700 Explorer.EXE Token: SeCreatePagefilePrivilege 1700 Explorer.EXE Token: SeShutdownPrivilege 1700 Explorer.EXE Token: SeCreatePagefilePrivilege 1700 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 1512 winver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exepid process 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1700 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exede81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exewinver.exedescription pid process target process PID 4008 wrote to memory of 3700 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 4008 wrote to memory of 3700 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 4008 wrote to memory of 3700 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 4008 wrote to memory of 3700 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 4008 wrote to memory of 3700 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 4008 wrote to memory of 3700 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 4008 wrote to memory of 3700 4008 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 3700 wrote to memory of 1512 3700 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 3700 wrote to memory of 1512 3700 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 3700 wrote to memory of 1512 3700 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 3700 wrote to memory of 1512 3700 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 1512 wrote to memory of 1700 1512 winver.exe Explorer.EXE PID 1512 wrote to memory of 2464 1512 winver.exe sihost.exe PID 1512 wrote to memory of 2484 1512 winver.exe svchost.exe PID 1512 wrote to memory of 2756 1512 winver.exe taskhostw.exe PID 1512 wrote to memory of 1700 1512 winver.exe Explorer.EXE PID 1512 wrote to memory of 3372 1512 winver.exe ShellExperienceHost.exe PID 1512 wrote to memory of 3384 1512 winver.exe SearchUI.exe PID 1512 wrote to memory of 3584 1512 winver.exe RuntimeBroker.exe PID 1512 wrote to memory of 3872 1512 winver.exe DllHost.exe PID 1512 wrote to memory of 2500 1512 winver.exe DllHost.exe PID 1512 wrote to memory of 1144 1512 winver.exe PID 1512 wrote to memory of 2144 1512 winver.exe WerFault.exe PID 1512 wrote to memory of 3964 1512 winver.exe slui.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe"C:\Users\Admin\AppData\Local\Temp\de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe"C:\Users\Admin\AppData\Local\Temp\de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1512
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3372
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3872
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3872 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3584
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3384
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2756
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2484
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2464
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2500
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵PID:3964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1512-118-0x0000000000000000-mapping.dmp
-
memory/1512-121-0x0000000002DE0000-0x0000000002DE7000-memory.dmpFilesize
28KB
-
memory/1700-129-0x00007FFFB71C0000-0x00007FFFB71C1000-memory.dmpFilesize
4KB
-
memory/1700-122-0x0000000000F00000-0x0000000000F07000-memory.dmpFilesize
28KB
-
memory/1700-123-0x0000000000F10000-0x0000000000F17000-memory.dmpFilesize
28KB
-
memory/2144-130-0x0000000000CE0000-0x0000000000CE7000-memory.dmpFilesize
28KB
-
memory/2464-124-0x0000000000550000-0x0000000000557000-memory.dmpFilesize
28KB
-
memory/2484-125-0x00000000000E0000-0x00000000000E7000-memory.dmpFilesize
28KB
-
memory/2500-128-0x0000000000BE0000-0x0000000000BE7000-memory.dmpFilesize
28KB
-
memory/2756-126-0x00000000002F0000-0x00000000002F7000-memory.dmpFilesize
28KB
-
memory/3584-127-0x00000000009C0000-0x00000000009C7000-memory.dmpFilesize
28KB
-
memory/3700-116-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3700-120-0x0000000000650000-0x000000000079A000-memory.dmpFilesize
1.3MB
-
memory/3700-117-0x0000000000401000-mapping.dmp
-
memory/3964-131-0x0000000000790000-0x0000000000797000-memory.dmpFilesize
28KB