5737635acfdbc4831002ff2777a8b4ec3c7e11a93825e58ad6981b066c840dc0

Analysis

max time kernel
110s
max time network
128s
platform
windows10_x64
resource
win10-en-20211104
submitted
02-12-2021 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creative_Cloud_Set-Up.exe
Size

2.4MB
MD5

aaa117386cb47343ff74c4da553d22c1
SHA1

4485a0abbf66211c0e210f27fbb03dd86d7cd58e
SHA256

5737635acfdbc4831002ff2777a8b4ec3c7e11a93825e58ad6981b066c840dc0
SHA512

20ae835a513e01512c47ef6fc1f6a0d64d86e4c67140da7a8717bba819d57328ae4c5a0568603c4e1f8aa08ae6de539008961cc3bc85091cd8f687bfdcb38fae

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2076 2724 WerFault.exe Creative_Cloud_Set-Up.exe

pid	pid_target	process	target process
2076	2724	WerFault.exe	Creative_Cloud_Set-Up.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

Creative_Cloud_Set-Up.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Creative_Cloud_Set-Up.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Creative_Cloud_Set-Up.exe = "11001"	Creative_Cloud_Set-Up.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

Creative_Cloud_Set-Up.exeWerFault.exe

pid	process
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2724	Creative_Cloud_Set-Up.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

Creative_Cloud_Set-Up.exeWerFault.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2724	Creative_Cloud_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	2724	Creative_Cloud_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	2724	Creative_Cloud_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	2724	Creative_Cloud_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	2724	Creative_Cloud_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	2724	Creative_Cloud_Set-Up.exe
Token: SeRestorePrivilege	2076	WerFault.exe
Token: SeBackupPrivilege	2076	WerFault.exe
Token: SeDebugPrivilege	2076	WerFault.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Creative_Cloud_Set-Up.exe

pid process

2724 Creative_Cloud_Set-Up.exe
2724 Creative_Cloud_Set-Up.exe

C:\Users\Admin\AppData\Local\Temp\Creative_Cloud_Set-Up.exe
"C:\Users\Admin\AppData\Local\Temp\Creative_Cloud_Set-Up.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 2612
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads