Analysis
- max time kernel
45s - max time network
115s - platform
windows10_x64 - resource
win10v20210410 - submitted
25/08/2021, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
2dfd26b62aed469c649521c77e2272d7.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2dfd26b62aed469c649521c77e2272d7.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 2dfd26b62aed469c649521c77e2272d7.exe
- Size 395KB
- Sample210825-62sn6w9rl2
- SHA256 89299028b5bc71b904bb9081ff287c61ddff5911ccee0ea483d7c479fd3dc5f0
- MD5 2dfd26b62aed469c649521c77e2272d7
- SHA1 d6b662fb5f393873210016a35d238d0740f10481
- SHA512 6878a4e39d5e395017a286a4e823fba08c206a3879c8504919224e6a5e6183fcc75f6751777afd4ff3932d22465860861d8a4104955999eb5035711ab1ca906f
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 204 33A2E4F0.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 2dfd26b62aed469c649521c77e2272d7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" 2dfd26b62aed469c649521c77e2272d7.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run 2dfd26b62aed469c649521c77e2272d7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" 2dfd26b62aed469c649521c77e2272d7.exe - Program crash 9 IoCs
pid pid_target Process procid_target 3784 204 WerFault.exe 78 3388 204 WerFault.exe 78 3716 204 WerFault.exe 78 1608 204 WerFault.exe 78 2132 204 WerFault.exe 78 2100 204 WerFault.exe 78 3856 204 WerFault.exe 78 3860 204 WerFault.exe 78 1148 204 WerFault.exe 78 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3388 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 3716 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 1608 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeRestorePrivilege 3784 WerFault.exe Token: SeBackupPrivilege 3784 WerFault.exe Token: SeDebugPrivilege 3784 WerFault.exe Token: SeDebugPrivilege 3388 WerFault.exe Token: SeDebugPrivilege 3716 WerFault.exe Token: SeDebugPrivilege 1608 WerFault.exe Token: SeDebugPrivilege 2132 WerFault.exe Token: SeDebugPrivilege 2100 WerFault.exe Token: SeDebugPrivilege 3856 WerFault.exe Token: SeDebugPrivilege 3860 WerFault.exe Token: SeDebugPrivilege 1148 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3904 wrote to memory of 204 3904 2dfd26b62aed469c649521c77e2272d7.exe 78 PID 3904 wrote to memory of 204 3904 2dfd26b62aed469c649521c77e2272d7.exe 78 PID 3904 wrote to memory of 204 3904 2dfd26b62aed469c649521c77e2272d7.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dfd26b62aed469c649521c77e2272d7.exe"C:\Users\Admin\AppData\Local\Temp\2dfd26b62aed469c649521c77e2272d7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"2⤵
- Executes dropped EXE
PID:204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 7323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 7003⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 6803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 7403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 6803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 7163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 7763⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 7243⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 8123⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-