508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6

General

Target

508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
Size

2.8MB
MD5

b8954cf8459693343ef1d16ed643a975
SHA1

8c153541354d3365a8eabd5b541b4e1dadcf9095
SHA256

508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6
SHA512

aac83096a400cf00b031787f7d31b4fb5ebc965cad6ab8698ddef3a1672608293ef5e52ca3f0bed206b3e4c19e329831503835b66f61803e00c5d03b059cfa06

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3272 created 3892 3272 WerFault.exe 508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe

description	pid	process	target process
PID 3272 created 3892	3272	WerFault.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe

Drops desktop.ini file(s) 6 IoCs

Processes:

508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe

description	ioc	process
File created	\??\c:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\desktop.ini	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\desktop.ini	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe

Drops file in Program Files directory 64 IoCs

Processes:

508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ja.pak	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\bin\java.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\id.txt	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\pt-br.txt	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ExtExport.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\jre\bin\javafx_font_t2k.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\db\lib\derbynet.jar	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado26.tlb	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipshi.xml	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.c	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\89.0.4389.114\v8_context_snapshot.bin	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\include\win32\jni_md.h	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\nl.txt	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\System\ado\msador28.tlb	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\uz.txt	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\ffjcext.zip	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\kaa.txt	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\tr.txt	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado21.tlb	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pl.jar	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File created	\??\c:\Program Files\Common Files\System\ado\msadox.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\am.pak	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ko.pak	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgePackages.h	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Common Files\System\wab32res.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\include\jawt.h	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\include\jvmti.h	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\jre\bin\hprof.dll	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3272 3892 WerFault.exe 508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe

pid	pid_target	process	target process
3272	3892	WerFault.exe	508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe
3272	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3272 WerFault.exe
Token: SeBackupPrivilege 3272 WerFault.exe
Token: SeDebugPrivilege 3272 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3272	WerFault.exe
Token: SeBackupPrivilege	3272	WerFault.exe
Token: SeDebugPrivilege	3272	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe
"C:\Users\Admin\AppData\Local\Temp\508a1a0a90a6386e7c25ee6d301568d0fa5b3d900bb22e84d7bbf885a01eaaa6.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 556
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads