8561226f674aeb4abc1b9910ddc4855ac8ac2fcd4f5face1f84e34878ac98afc

Analysis

max time kernel
151s
max time network
122s
platform
windows7_x64
resource
win7-en-20211014
submitted
23-11-2021 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Size

71KB
MD5

10aa058a3ac49e016cad7987b8e09886
SHA1

cca6682330a819592c3b1ea0448ceb4e141593dc
SHA256

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db
SHA512

f115fb62b1ca5e18f6340d42ff4393e2b175917312ae1cc14e7a6a9322cf8adaf22457bc8213e2baafdc2cb19d5db1e5a9c003155cbf142d5a08604495e22f6e

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe

pid process

1924 6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

640 1924 WerFault.exe 6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe

pid	pid_target	process	target process
640	1924	WerFault.exe	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe

Modifies Control Panel 1 IoCs

evasion

Processes:

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\International	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exeWerFault.exe

pid	process
1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
640	WerFault.exe
640	WerFault.exe
640	WerFault.exe
640	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

640 WerFault.exe

pid	process
640	WerFault.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exeWerFault.exe

description	pid	process
Token: SeBackupPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeDebugPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: 36	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeImpersonatePrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeIncBasePriorityPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeIncreaseQuotaPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: 33	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeManageVolumePrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeProfSingleProcessPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeRestorePrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeSecurityPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeSystemProfilePrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeTakeOwnershipPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeShutdownPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeDebugPrivilege	640	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe

description	pid	process	target process
PID 1924 wrote to memory of 640	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe	WerFault.exe
PID 1924 wrote to memory of 640	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe	WerFault.exe
PID 1924 wrote to memory of 640	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe	WerFault.exe
PID 1924 wrote to memory of 640	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
"C:\Users\Admin\AppData\Local\Temp\6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 508
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:640

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-59-0x0000000000000000-mapping.dmp

Download
memory/640-60-0x0000000000280000-0x00000000002E0000-memory.dmp

Filesize
384KB

Download
memory/1924-55-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download
memory/1924-56-0x00000000008F5000-0x0000000000906000-memory.dmp

Filesize
68KB

Download
memory/1924-57-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/1924-58-0x0000000000906000-0x0000000000907000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads