31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58

General

Target

31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
Size

181KB
MD5

6bdae60cfe8456949b7c6a5d05e14fed
SHA1

07e68e795fea7324ab2605ec2578b2527b4afec3
SHA256

31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58
SHA512

93c7de75b2ac43f8b92895d75c33e0049f964d1d41fd4c1e019e286cbffb0621adf405654e081fdf4162b57c8d516cb437e77ac5d5c5f59a807bdf1291599a64

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3616	winpxhd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update 39405 = "C:\\Windows\\10459579915093179\\winpxhd.exe"	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update 39405 = "C:\\Windows\\10459579915093179\\winpxhd.exe"	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\10459579915093179\winpxhd.exe	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
File opened for modification	C:\Windows\10459579915093179\winpxhd.exe	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
File opened for modification	C:\Windows\10459579915093179	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
676	1540	WerFault.exe	80
4384	3616	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3616	1540	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe	81
PID 1540 wrote to memory of 3616	1540	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe	81
PID 1540 wrote to memory of 3616	1540	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe	81

C:\Users\Admin\AppData\Local\Temp\31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
"C:\Users\Admin\AppData\Local\Temp\31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\10459579915093179\winpxhd.exe
  C:\Windows\10459579915093179\winpxhd.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 672
    3⤵
    - Program crash
    PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 456
  2⤵
  - Program crash
  PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1540 -ip 1540
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3616 -ip 3616
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\10459579915093179\winpxhd.exe

Filesize
181KB

MD5
6bdae60cfe8456949b7c6a5d05e14fed

SHA1
07e68e795fea7324ab2605ec2578b2527b4afec3

SHA256
31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58

SHA512
93c7de75b2ac43f8b92895d75c33e0049f964d1d41fd4c1e019e286cbffb0621adf405654e081fdf4162b57c8d516cb437e77ac5d5c5f59a807bdf1291599a64

Download Submit
C:\Windows\10459579915093179\winpxhd.exe

Filesize
181KB

MD5
6bdae60cfe8456949b7c6a5d05e14fed

SHA1
07e68e795fea7324ab2605ec2578b2527b4afec3

SHA256
31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58

SHA512
93c7de75b2ac43f8b92895d75c33e0049f964d1d41fd4c1e019e286cbffb0621adf405654e081fdf4162b57c8d516cb437e77ac5d5c5f59a807bdf1291599a64

Download Submit
memory/1540-130-0x000000000532F000-0x0000000005333000-memory.dmp

Filesize
16KB

Download
memory/1540-131-0x000000000532F000-0x0000000005333000-memory.dmp

Filesize
16KB

Download
memory/1540-132-0x0000000000400000-0x0000000005295000-memory.dmp

Filesize
78.6MB

Download
memory/3616-136-0x00000000054FF000-0x0000000005504000-memory.dmp

Filesize
20KB

Download
memory/3616-137-0x0000000000400000-0x0000000005295000-memory.dmp

Filesize
78.6MB

Download
memory/3616-138-0x00000000054FF000-0x0000000005504000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing