Analysis
- max time kernel
33s - max time network
136s - platform
windows10_x64 - resource
win10v20210410 - submitted
13/08/2021, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
8f9dcd3767ab979a0f9f71cef8322175.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8f9dcd3767ab979a0f9f71cef8322175.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 8f9dcd3767ab979a0f9f71cef8322175.exe
- Size 376KB
- Sample210813-2crdasycba
- SHA256 d00956a63d7e56ec5fc098fdc2227523e3022cae1f144c783d64044366d0789c
- MD5 8f9dcd3767ab979a0f9f71cef8322175
- SHA1 6e0abd5fb773e339128f1a9a5828d19097491d8c
- SHA512 497a49a75eaf3de691177b81eccb70b54c19ab23229305da964df87b6de689f6f49e514837469a1fb5565780de9b8b6c24207dc98a389b2512fd313e05d80e47
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3056 33A2E4F0.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 8f9dcd3767ab979a0f9f71cef8322175.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" 8f9dcd3767ab979a0f9f71cef8322175.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run 8f9dcd3767ab979a0f9f71cef8322175.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" 8f9dcd3767ab979a0f9f71cef8322175.exe - Program crash 9 IoCs
pid pid_target Process procid_target 2620 3056 WerFault.exe 76 1852 3056 WerFault.exe 76 2272 3056 WerFault.exe 76 748 3056 WerFault.exe 76 3964 3056 WerFault.exe 76 3428 3056 WerFault.exe 76 4076 3056 WerFault.exe 76 3756 3056 WerFault.exe 76 2588 3056 WerFault.exe 76 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 2620 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe 3964 WerFault.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeRestorePrivilege 2620 WerFault.exe Token: SeBackupPrivilege 2620 WerFault.exe Token: SeDebugPrivilege 2620 WerFault.exe Token: SeDebugPrivilege 1852 WerFault.exe Token: SeDebugPrivilege 2272 WerFault.exe Token: SeDebugPrivilege 748 WerFault.exe Token: SeDebugPrivilege 3964 WerFault.exe Token: SeDebugPrivilege 3428 WerFault.exe Token: SeDebugPrivilege 4076 WerFault.exe Token: SeDebugPrivilege 3756 WerFault.exe Token: SeDebugPrivilege 2588 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3680 wrote to memory of 3056 3680 8f9dcd3767ab979a0f9f71cef8322175.exe 76 PID 3680 wrote to memory of 3056 3680 8f9dcd3767ab979a0f9f71cef8322175.exe 76 PID 3680 wrote to memory of 3056 3680 8f9dcd3767ab979a0f9f71cef8322175.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f9dcd3767ab979a0f9f71cef8322175.exe"C:\Users\Admin\AppData\Local\Temp\8f9dcd3767ab979a0f9f71cef8322175.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"2⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 2403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7243⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 8083⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-