Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 13:30
Static task
static1
Behavioral task
behavioral1
Sample
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe
Resource
win10v2004-20220414-en
General
-
Target
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe
-
Size
187KB
-
MD5
247209d2f18ecdefb4d7878d989fb6c7
-
SHA1
bb5319e0cb0088cbafe8b838a140b9f9c497adbe
-
SHA256
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909
-
SHA512
9526e76458717c39453a700e2ec14c5748876cc7a1d62c5546923591be7123a2c36111bfda6bceda0473dfe41b0c787e70aa65641d5f165bd8accaeb3b835dc1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
winsvcs.exepid process 4932 winsvcs.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\708047050608564070\\winsvcs.exe" 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\708047050608564070\\winsvcs.exe" 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe -
Drops file in Windows directory 3 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exedescription ioc process File created C:\Windows\708047050608564070\winsvcs.exe 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe File opened for modification C:\Windows\708047050608564070\winsvcs.exe 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe File opened for modification C:\Windows\708047050608564070 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3104 2416 WerFault.exe 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2064 4932 WerFault.exe winsvcs.exe 1596 2416 WerFault.exe 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 4224 4932 WerFault.exe winsvcs.exe 4656 2416 WerFault.exe 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2072 4932 WerFault.exe winsvcs.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exewinsvcs.exepid process 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe 4932 winsvcs.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exepid process 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exedescription pid process target process PID 2416 wrote to memory of 4932 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe winsvcs.exe PID 2416 wrote to memory of 4932 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe winsvcs.exe PID 2416 wrote to memory of 4932 2416 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe winsvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe"C:\Users\Admin\AppData\Local\Temp\29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
-
C:\Windows\708047050608564070\winsvcs.exeC:\Windows\708047050608564070\winsvcs.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 6563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 6763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 6522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 7122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2416 -ip 24161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4932 -ip 49321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2416 -ip 24161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4932 -ip 49321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2416 -ip 24161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4932 -ip 49321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\708047050608564070\winsvcs.exeFilesize
187KB
MD5247209d2f18ecdefb4d7878d989fb6c7
SHA1bb5319e0cb0088cbafe8b838a140b9f9c497adbe
SHA25629b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909
SHA5129526e76458717c39453a700e2ec14c5748876cc7a1d62c5546923591be7123a2c36111bfda6bceda0473dfe41b0c787e70aa65641d5f165bd8accaeb3b835dc1
-
C:\Windows\708047050608564070\winsvcs.exeFilesize
187KB
MD5247209d2f18ecdefb4d7878d989fb6c7
SHA1bb5319e0cb0088cbafe8b838a140b9f9c497adbe
SHA25629b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909
SHA5129526e76458717c39453a700e2ec14c5748876cc7a1d62c5546923591be7123a2c36111bfda6bceda0473dfe41b0c787e70aa65641d5f165bd8accaeb3b835dc1
-
memory/2416-130-0x000000000076E000-0x0000000000774000-memory.dmpFilesize
24KB
-
memory/2416-131-0x000000000076E000-0x0000000000774000-memory.dmpFilesize
24KB
-
memory/2416-132-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2416-139-0x000000000076E000-0x0000000000774000-memory.dmpFilesize
24KB
-
memory/4932-133-0x0000000000000000-mapping.dmp
-
memory/4932-136-0x00000000005D0000-0x00000000005D5000-memory.dmpFilesize
20KB
-
memory/4932-137-0x00000000005D0000-0x00000000005D5000-memory.dmpFilesize
20KB
-
memory/4932-138-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB