Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-06-2022 10:18
Static task
static1
Behavioral task
behavioral1
Sample
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe
Resource
win10v2004-20220414-en
General
-
Target
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe
-
Size
89KB
-
MD5
00f3c5e9de28495de0aeba766e905b7d
-
SHA1
da6e3dc9163fb2626aa5c514c99925420f05eb82
-
SHA256
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639
-
SHA512
011316f4ff28f0841823dd61af6ece96de33007cbe679f89deb917f96c8b17d8fd8e01733c2a44d4b536cdc5bb7e82d1c3a9ee22fa7d6dc4066e76ff9ef36967
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 2 IoCs
Processes:
AdobeARMS.exeAdobeARMS.exepid process 5088 AdobeARMS.exe 3480 AdobeARMS.exe -
Processes:
resource yara_rule behavioral2/memory/4692-131-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/4692-132-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/4692-133-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/4692-136-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/4692-137-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/4692-141-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/3480-149-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/3480-150-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/3480-151-0x0000000000400000-0x000000000048B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exeAdobeARMS.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\patches = "1" 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "\\AdobeARMS.exe" AdobeARMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" AdobeARMS.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exeAdobeARMS.exedescription pid process target process PID 4436 set thread context of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 5088 set thread context of 3480 5088 AdobeARMS.exe AdobeARMS.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2124 4436 WerFault.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 1432 5088 WerFault.exe AdobeARMS.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exeAdobeARMS.exedescription pid process target process PID 4436 wrote to memory of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 4436 wrote to memory of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 4436 wrote to memory of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 4436 wrote to memory of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 4436 wrote to memory of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 4436 wrote to memory of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 4436 wrote to memory of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 4436 wrote to memory of 4692 4436 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe PID 4692 wrote to memory of 5088 4692 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe AdobeARMS.exe PID 4692 wrote to memory of 5088 4692 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe AdobeARMS.exe PID 4692 wrote to memory of 5088 4692 110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe AdobeARMS.exe PID 5088 wrote to memory of 3480 5088 AdobeARMS.exe AdobeARMS.exe PID 5088 wrote to memory of 3480 5088 AdobeARMS.exe AdobeARMS.exe PID 5088 wrote to memory of 3480 5088 AdobeARMS.exe AdobeARMS.exe PID 5088 wrote to memory of 3480 5088 AdobeARMS.exe AdobeARMS.exe PID 5088 wrote to memory of 3480 5088 AdobeARMS.exe AdobeARMS.exe PID 5088 wrote to memory of 3480 5088 AdobeARMS.exe AdobeARMS.exe PID 5088 wrote to memory of 3480 5088 AdobeARMS.exe AdobeARMS.exe PID 5088 wrote to memory of 3480 5088 AdobeARMS.exe AdobeARMS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe"C:\Users\Admin\AppData\Local\Temp\110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 3842⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe"C:\Users\Admin\AppData\Local\Temp\110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeARMS.exeC:\Users\Admin\AppData\Roaming\AdobeARMS.exe 908 "C:\Users\Admin\AppData\Local\Temp\110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 3884⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4436 -ip 44361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5088 -ip 50881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AdobeARMS.exeFilesize
89KB
MD500f3c5e9de28495de0aeba766e905b7d
SHA1da6e3dc9163fb2626aa5c514c99925420f05eb82
SHA256110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639
SHA512011316f4ff28f0841823dd61af6ece96de33007cbe679f89deb917f96c8b17d8fd8e01733c2a44d4b536cdc5bb7e82d1c3a9ee22fa7d6dc4066e76ff9ef36967
-
C:\Users\Admin\AppData\Roaming\AdobeARMS.exeFilesize
89KB
MD500f3c5e9de28495de0aeba766e905b7d
SHA1da6e3dc9163fb2626aa5c514c99925420f05eb82
SHA256110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639
SHA512011316f4ff28f0841823dd61af6ece96de33007cbe679f89deb917f96c8b17d8fd8e01733c2a44d4b536cdc5bb7e82d1c3a9ee22fa7d6dc4066e76ff9ef36967
-
C:\Users\Admin\AppData\Roaming\AdobeARMS.exeFilesize
89KB
MD500f3c5e9de28495de0aeba766e905b7d
SHA1da6e3dc9163fb2626aa5c514c99925420f05eb82
SHA256110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639
SHA512011316f4ff28f0841823dd61af6ece96de33007cbe679f89deb917f96c8b17d8fd8e01733c2a44d4b536cdc5bb7e82d1c3a9ee22fa7d6dc4066e76ff9ef36967
-
memory/3480-151-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3480-150-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3480-149-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3480-142-0x0000000000000000-mapping.dmp
-
memory/4692-141-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4692-130-0x0000000000000000-mapping.dmp
-
memory/4692-137-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4692-136-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4692-133-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4692-132-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4692-131-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/5088-138-0x0000000000000000-mapping.dmp