Analysis

  • max time kernel
    190s
  • max time network
    161s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 05:15

General

  • Target

    c0c3ef8bee653f8880f6a4180561b27983d4e19e0bd2d83edb76243bce21f96b.exe

  • Size

    83KB

  • MD5

    13c4083bdb893c8a0bd2930fa55962ca

  • SHA1

    c908cc99bfe3c1a039dacbe43866625ace75d342

  • SHA256

    c0c3ef8bee653f8880f6a4180561b27983d4e19e0bd2d83edb76243bce21f96b

  • SHA512

    fc1e855dc63c5934d2d7fcb7d2291bbd6795899bfe288932643c3732c514c8df0508a3ba918f124f72207835afd85c14840a2aacbafc99f049cc53a77f6855cc

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0c3ef8bee653f8880f6a4180561b27983d4e19e0bd2d83edb76243bce21f96b.exe
    "C:\Users\Admin\AppData\Local\Temp\c0c3ef8bee653f8880f6a4180561b27983d4e19e0bd2d83edb76243bce21f96b.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:1180
  • C:\Windows\system32\WerFault.exe
    "C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20220130-1119.dmp
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:364

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1180-118-0x0000000010000000-0x000000001000A000-memory.dmp
    Filesize

    40KB

  • memory/1180-122-0x0000000000A20000-0x0000000000AE0000-memory.dmp
    Filesize

    768KB