Analysis
- max time kernel
45s - max time network
135s - platform
windows10_x64 - resource
win10v20210410 - submitted
25/08/2021, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
4fde5496bc06e055df52b93f304b2bf1.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4fde5496bc06e055df52b93f304b2bf1.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 4fde5496bc06e055df52b93f304b2bf1.exe
- Size 372KB
- Sample210825-xatrh6eyce
- SHA256 ccd975821967733598a3d588a2ac2f65fdb2dfbc254713d3726c0709976dc9f7
- MD5 4fde5496bc06e055df52b93f304b2bf1
- SHA1 799cad76d1798518e4f56efd7d3b3cf37da84e89
- SHA512 00ab17e3ef19f906d4f03a2a3b03d8b0c97c427105ecabf3f10094380bf62f4588d1c174196b23af44acd59740e0a33292d181b8e6319e595fb010ce7202b830
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2444 33A2E4F0.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 4fde5496bc06e055df52b93f304b2bf1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" 4fde5496bc06e055df52b93f304b2bf1.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run 4fde5496bc06e055df52b93f304b2bf1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" 4fde5496bc06e055df52b93f304b2bf1.exe - Program crash 9 IoCs
pid pid_target Process procid_target 3464 2444 WerFault.exe 78 1168 2444 WerFault.exe 78 776 2444 WerFault.exe 78 3948 2444 WerFault.exe 78 624 2444 WerFault.exe 78 1552 2444 WerFault.exe 78 3764 2444 WerFault.exe 78 2628 2444 WerFault.exe 78 3036 2444 WerFault.exe 78 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 624 WerFault.exe 624 WerFault.exe 624 WerFault.exe 624 WerFault.exe 624 WerFault.exe 624 WerFault.exe 624 WerFault.exe 624 WerFault.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeRestorePrivilege 3464 WerFault.exe Token: SeBackupPrivilege 3464 WerFault.exe Token: SeDebugPrivilege 3464 WerFault.exe Token: SeDebugPrivilege 1168 WerFault.exe Token: SeDebugPrivilege 776 WerFault.exe Token: SeDebugPrivilege 3948 WerFault.exe Token: SeDebugPrivilege 624 WerFault.exe Token: SeDebugPrivilege 1552 WerFault.exe Token: SeDebugPrivilege 3764 WerFault.exe Token: SeDebugPrivilege 2628 WerFault.exe Token: SeDebugPrivilege 3036 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3212 wrote to memory of 2444 3212 4fde5496bc06e055df52b93f304b2bf1.exe 78 PID 3212 wrote to memory of 2444 3212 4fde5496bc06e055df52b93f304b2bf1.exe 78 PID 3212 wrote to memory of 2444 3212 4fde5496bc06e055df52b93f304b2bf1.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fde5496bc06e055df52b93f304b2bf1.exe"C:\Users\Admin\AppData\Local\Temp\4fde5496bc06e055df52b93f304b2bf1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"2⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 7323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 7083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 8043⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 7803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 6923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 8043⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 7203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 7003⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 8163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-