27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-05-2022 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe
Size

994KB
MD5

87b19be58879f1fc7052851a1a9192ff
SHA1

ec586f8577f60677e9fc2ca9fe53174169f19c60
SHA256

27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45
SHA512

1fcab9718ba6b2011e50a64ce59b03cb8a69cb523d4ad7dac56b1bc9e95740da38cab01311c0e591e341dfd8e87f040dbe00b21e95077c19172b770bde9b0cc7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ArzQT = "C:\\JVJHUWZP\\ArzQTu\\ArzQTujHU.vbs"	27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4988 4580 WerFault.exe 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe

pid	pid_target	process	target process
4988	4580	WerFault.exe	27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe

C:\Users\Admin\AppData\Local\Temp\27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe
"C:\Users\Admin\AppData\Local\Temp\27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe"
1⤵
- Adds Run key to start application
- Maps connected drives based on registry
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 7576
2⤵
- Program crash
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4580 -ip 4580
1⤵
PID:4424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4580-130-0x0000000000350000-0x000000000044E000-memory.dmp

Filesize
1016KB

Download
memory/4580-131-0x0000000005660000-0x0000000005C04000-memory.dmp

Filesize
5.6MB

Download
memory/4580-132-0x00000000050B0000-0x0000000005654000-memory.dmp

Filesize
5.6MB

Download