Analysis
-
max time kernel
125s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
44fcb60fa4a1d0535b891a0d7f603975.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
44fcb60fa4a1d0535b891a0d7f603975.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
-
Target
44fcb60fa4a1d0535b891a0d7f603975.exe
-
Size
917KB
-
MD5
44fcb60fa4a1d0535b891a0d7f603975
-
SHA1
d526556c835337c2ca87c00d3ce3e430751bb3e2
-
SHA256
72a13a9e54e095c5878be67503dd808a7332cb631c4c615d65d69e2de47b080f
-
SHA512
537679df43c2924a7d409a527c929cab061e97b135f94110957ce4cb4193efc79b8d9962a8e56969a822534a161755c4cb99bb1caaf5804fe55f849716b414bb
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
44fcb60fa4a1d0535b891a0d7f603975.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uhexymko = "C:\\Users\\Public\\Libraries\\okmyxehU.url" 44fcb60fa4a1d0535b891a0d7f603975.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1164 1880 WerFault.exe mshta.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1164 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1164 WerFault.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
44fcb60fa4a1d0535b891a0d7f603975.exemshta.exedescription pid process target process PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1984 wrote to memory of 1880 1984 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 1880 wrote to memory of 1164 1880 mshta.exe WerFault.exe PID 1880 wrote to memory of 1164 1880 mshta.exe WerFault.exe PID 1880 wrote to memory of 1164 1880 mshta.exe WerFault.exe PID 1880 wrote to memory of 1164 1880 mshta.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44fcb60fa4a1d0535b891a0d7f603975.exe"C:\Users\Admin\AppData\Local\Temp\44fcb60fa4a1d0535b891a0d7f603975.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 1363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-67-0x0000000000000000-mapping.dmp
-
memory/1164-73-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1880-65-0x0000000000000000-mapping.dmp
-
memory/1880-72-0x0000000010590000-0x000000001060C000-memory.dmpFilesize
496KB
-
memory/1880-71-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1880-70-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1880-69-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1984-63-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1984-64-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB