Overview
overview
10Static
static
1044b5d24e5e...in.exe
windows7_x64
144b5d24e5e...in.exe
windows10_x64
15987a6e42c...in.exe
windows7_x64
35987a6e42c...in.exe
windows10_x64
36424307ea2...in.exe
windows7_x64
16424307ea2...in.exe
windows10_x64
18e3993583c...in.exe
windows7_x64
18e3993583c...in.exe
windows10_x64
1ce399a2d07...in.exe
windows7_x64
1ce399a2d07...in.exe
windows10_x64
1d40a3503a9...in.exe
windows7_x64
1d40a3503a9...in.exe
windows10_x64
1d77901484e...in.exe
windows7_x64
1d77901484e...in.exe
windows10_x64
1Analysis
-
max time kernel
24s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en -
submitted
08-09-2021 12:48
Static task
static1
Behavioral task
behavioral1
Sample
44b5d24e5e8fd8e8ee7141f970f76a13c89dd26c44b336dc9d6b61fda3abf335.bin.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
44b5d24e5e8fd8e8ee7141f970f76a13c89dd26c44b336dc9d6b61fda3abf335.bin.exe
Resource
win10-en
Behavioral task
behavioral3
Sample
5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe
Resource
win10-en
Behavioral task
behavioral5
Sample
6424307ea25f1889e4b9fb8a64d860e42681cddf71a5a70af7963ab282225c8d.bin.exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
6424307ea25f1889e4b9fb8a64d860e42681cddf71a5a70af7963ab282225c8d.bin.exe
Resource
win10-en
Behavioral task
behavioral7
Sample
8e3993583cd2506ccbac4b247949ddee7d6971432576a0f9c485f9f0942054ae.bin.exe
Resource
win7-en
Behavioral task
behavioral8
Sample
8e3993583cd2506ccbac4b247949ddee7d6971432576a0f9c485f9f0942054ae.bin.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
ce399a2d07c0851164bd8cc9e940b84b88c43ef564846ca654df4abf36c278e6.bin.exe
Resource
win7-en
Behavioral task
behavioral10
Sample
ce399a2d07c0851164bd8cc9e940b84b88c43ef564846ca654df4abf36c278e6.bin.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
d40a3503a960663187a83f560e94563cd11606a610a4b176b0ac065af037f175.bin.exe
Resource
win7-en
Behavioral task
behavioral12
Sample
d40a3503a960663187a83f560e94563cd11606a610a4b176b0ac065af037f175.bin.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
d77901484e91445d8d11b82ff487b9e56b48930fe3086e5858ea754e9f490c1f.bin.exe
Resource
win7-en
Behavioral task
behavioral14
Sample
d77901484e91445d8d11b82ff487b9e56b48930fe3086e5858ea754e9f490c1f.bin.exe
Resource
win10-en
General
-
Target
5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe
-
Size
898KB
-
MD5
cb2b4cd74c7b57a12bd822a168e4e608
-
SHA1
f2182062719f0537071545b77ca75f39c2922bf5
-
SHA256
5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed
-
SHA512
7a38be8c1270b1224be4975ad442a964b2523c849f748e5356156cdce39e494c64ca80b0d99c1d989d77f072902de8972e0b113894c9791fb0cabf856dbba348
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3856 3908 WerFault.exe 5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe -
NTFS ADS 1 IoCs
Processes:
5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\C:\Windows\SysWOW64 5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3856 WerFault.exe Token: SeBackupPrivilege 3856 WerFault.exe Token: SeDebugPrivilege 3856 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe"C:\Users\Admin\AppData\Local\Temp\5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed.bin.exe"1⤵
- NTFS ADS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 15242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3908-115-0x0000000000EC0000-0x0000000000EF3000-memory.dmpFilesize
204KB