Analysis
- max time kernel
153s - max time network
156s - platform
windows10_x64 - resource
win10v20210408 - submitted
30/08/2021, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe
- Size 1024KB
- Sample210830-mvxbygrlns
- SHA256 aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50
- MD5 77836ffe5e63683035c4e06f1895a8c9
- SHA1 8d474e0f795e5f001cb5220002321468b21908cc
- SHA512 d81a871571de76583c40e0068dfad769fdb2cf738fb100d8f35ed833175d6b6a06d905325d2d765e627fc0d5250de6751628cae797b9af70ee687d20bc97a0e4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\39DE8EC6 = "C:\\Users\\Admin\\AppData\\Roaming\\39DE8EC6\\bin.exe" winver.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1428 3724 WerFault.exe 19 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2552 winver.exe 2552 winver.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 1428 WerFault.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe 2552 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2224 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeDebugPrivilege 1428 WerFault.exe Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2552 winver.exe 2224 Explorer.EXE 2224 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2224 Explorer.EXE 2224 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2224 Explorer.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 504 wrote to memory of 2552 504 aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe 76 PID 504 wrote to memory of 2552 504 aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe 76 PID 504 wrote to memory of 2552 504 aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe 76 PID 504 wrote to memory of 2552 504 aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe 76 PID 2552 wrote to memory of 2224 2552 winver.exe 22 PID 2552 wrote to memory of 2452 2552 winver.exe 30 PID 2552 wrote to memory of 2640 2552 winver.exe 25 PID 2552 wrote to memory of 2860 2552 winver.exe 23 PID 2552 wrote to memory of 2224 2552 winver.exe 22 PID 2552 wrote to memory of 3252 2552 winver.exe 13 PID 2552 wrote to memory of 3260 2552 winver.exe 21 PID 2552 wrote to memory of 3484 2552 winver.exe 20 PID 2552 wrote to memory of 3724 2552 winver.exe 19 PID 2552 wrote to memory of 1920 2552 winver.exe 75 PID 2552 wrote to memory of 1268 2552 winver.exe PID 2552 wrote to memory of 1428 2552 winver.exe 80 PID 2552 wrote to memory of 3864 2552 winver.exe 81
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3252
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3724
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3724 -s 8362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3484
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3260
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe"C:\Users\Admin\AppData\Local\Temp\aab084097faf61581e8edeaec21eb4a88adf96d2b5d70c64ee96f06e095f1d50.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2552
-
-
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2860
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2640
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2452
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:1920
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵PID:3864