Analysis
- max time kernel
34s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
11/08/2021, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
c001e22e9d251db0142937be78d2cff7.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c001e22e9d251db0142937be78d2cff7.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target c001e22e9d251db0142937be78d2cff7.exe
- Size 403KB
- Sample210811-n7bcwtepyx
- SHA256 32e30f494b7bb01ab18836029193c2a79fb63795f978eeed31103f368c6d8fba
- MD5 c001e22e9d251db0142937be78d2cff7
- SHA1 989e64aa3a86db05301da8b15b09bac7de0f04a7
- SHA512 7000349fd49a1eafeccde28553c4e668d7b07ee707b3f25ba5c242c98015900cb472795c83233126e177997d43113ca695311edf9eb63da46b701cb64fd284b5
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2460 33A2E4F0.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run c001e22e9d251db0142937be78d2cff7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" c001e22e9d251db0142937be78d2cff7.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run c001e22e9d251db0142937be78d2cff7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" c001e22e9d251db0142937be78d2cff7.exe - Program crash 9 IoCs
pid pid_target Process procid_target 184 2460 WerFault.exe 76 1972 2460 WerFault.exe 76 3960 2460 WerFault.exe 76 3984 2460 WerFault.exe 76 3580 2460 WerFault.exe 76 3480 2460 WerFault.exe 76 2132 2460 WerFault.exe 76 1356 2460 WerFault.exe 76 2504 2460 WerFault.exe 76 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeRestorePrivilege 184 WerFault.exe Token: SeBackupPrivilege 184 WerFault.exe Token: SeDebugPrivilege 184 WerFault.exe Token: SeDebugPrivilege 1972 WerFault.exe Token: SeDebugPrivilege 3960 WerFault.exe Token: SeDebugPrivilege 3984 WerFault.exe Token: SeDebugPrivilege 3580 WerFault.exe Token: SeDebugPrivilege 3480 WerFault.exe Token: SeDebugPrivilege 2132 WerFault.exe Token: SeDebugPrivilege 1356 WerFault.exe Token: SeDebugPrivilege 2504 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3916 wrote to memory of 2460 3916 c001e22e9d251db0142937be78d2cff7.exe 76 PID 3916 wrote to memory of 2460 3916 c001e22e9d251db0142937be78d2cff7.exe 76 PID 3916 wrote to memory of 2460 3916 c001e22e9d251db0142937be78d2cff7.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\c001e22e9d251db0142937be78d2cff7.exe"C:\Users\Admin\AppData\Local\Temp\c001e22e9d251db0142937be78d2cff7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"2⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 7323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 7363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 6963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 7123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 7323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 7003⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 7363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 7443⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 8163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-