78fe3ed0e50009101124d757b0ff13967a5eda787ddad427276779c4d343ce2c

General

Target

Materials.exe
Size

357KB
MD5

8bd9a34cf06fa228b4ccd401808723cc
SHA1

e17daeaf2e0dcfdbaf026866c00fefb0beb47520
SHA256

38f3aadc65df16aed9f5bbaa5f42598d3fd9b29811429fcddd679a40b092fca0
SHA512

3d3ac1d0d90125fba07ca8a6fe0bb75a95b47b1caf177854b9e476aede2cefe396c68bb68c7dde0e32b22a740708aa3f23dd3726f3789504b83fd0b195c0479e

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4764 created 4444 4764 WerFault.exe Materials.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Materials.exe

description pid process target process

PID 1836 set thread context of 4444 1836 Materials.exe Materials.exe

description	pid	process	target process
PID 4764 created 4444	4764	WerFault.exe	Materials.exe

description	pid	process	target process
PID 1836 set thread context of 4444	1836	Materials.exe	Materials.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1564 4444 WerFault.exe Materials.exe

pid	pid_target	process	target process
1564	4444	WerFault.exe	Materials.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WerFault.exe

pid process

1564 WerFault.exe
1564 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Materials.exe

pid process

1836 Materials.exe

pid	process
1564	WerFault.exe
1564	WerFault.exe

pid	process
1836	Materials.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

WerFault.exesvchost.exe

description	pid	process
Token: SeRestorePrivilege	1564	WerFault.exe
Token: SeBackupPrivilege	1564	WerFault.exe
Token: SeShutdownPrivilege	4952	svchost.exe
Token: SeCreatePagefilePrivilege	4952	svchost.exe
Token: SeShutdownPrivilege	4952	svchost.exe
Token: SeCreatePagefilePrivilege	4952	svchost.exe
Token: SeShutdownPrivilege	4952	svchost.exe
Token: SeCreatePagefilePrivilege	4952	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Materials.exeWerFault.exe

description	pid	process	target process
PID 1836 wrote to memory of 4648	1836	Materials.exe	cmd.exe
PID 1836 wrote to memory of 4648	1836	Materials.exe	cmd.exe
PID 1836 wrote to memory of 4648	1836	Materials.exe	cmd.exe
PID 1836 wrote to memory of 4592	1836	Materials.exe	cmd.exe
PID 1836 wrote to memory of 4592	1836	Materials.exe	cmd.exe
PID 1836 wrote to memory of 4592	1836	Materials.exe	cmd.exe
PID 1836 wrote to memory of 4444	1836	Materials.exe	Materials.exe
PID 1836 wrote to memory of 4444	1836	Materials.exe	Materials.exe
PID 1836 wrote to memory of 4444	1836	Materials.exe	Materials.exe
PID 1836 wrote to memory of 4444	1836	Materials.exe	Materials.exe
PID 4764 wrote to memory of 4444	4764	WerFault.exe	Materials.exe
PID 4764 wrote to memory of 4444	4764	WerFault.exe	Materials.exe

C:\Users\Admin\AppData\Local\Temp\Materials.exe
"C:\Users\Admin\AppData\Local\Temp\Materials.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:4648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:4592

C:\Users\Admin\AppData\Local\Temp\Materials.exe
"C:\Users\Admin\AppData\Local\Temp\Materials.exe"
2⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 24
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4444 -ip 4444
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-133-0x000000000054D000-0x0000000000550000-memory.dmp

Filesize
12KB

Download
memory/4952-134-0x0000021EE6560000-0x0000021EE6570000-memory.dmp

Filesize
64KB

Download
memory/4952-135-0x0000021EE6B20000-0x0000021EE6B30000-memory.dmp

Filesize
64KB

Download
memory/4952-136-0x0000021EE9190000-0x0000021EE9194000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads