2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f

General

Target

2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
Size

187KB
MD5

b493b808ebd71c67996645db038807e4
SHA1

8c9bae6be1e3739c3b55a0726474d062332ee88b
SHA256

2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f
SHA512

7abde54858086a9d16d0cf430d7eb6ec413e259b56ed0e946103f812056a7423db24779e38c2f73fdc7ff047797f2ddf99600708155e03b274a4bd2c1fd58c2e

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4672	winclfz.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update 97865 = "C:\\Windows\\8397445313305334\\winclfz.exe"	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update 97865 = "C:\\Windows\\8397445313305334\\winclfz.exe"	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\8397445313305334\winclfz.exe	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
File opened for modification	C:\Windows\8397445313305334\winclfz.exe	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
File opened for modification	C:\Windows\8397445313305334	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
860	4060	WerFault.exe	80
3756	4672	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4672	4060	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe	82
PID 4060 wrote to memory of 4672	4060	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe	82
PID 4060 wrote to memory of 4672	4060	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe	82

C:\Users\Admin\AppData\Local\Temp\2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
"C:\Users\Admin\AppData\Local\Temp\2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\8397445313305334\winclfz.exe
  C:\Windows\8397445313305334\winclfz.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 672
    3⤵
    - Program crash
    PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 476
  2⤵
  - Program crash
  PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4060 -ip 4060
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4672 -ip 4672
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\8397445313305334\winclfz.exe

Filesize
187KB

MD5
b493b808ebd71c67996645db038807e4

SHA1
8c9bae6be1e3739c3b55a0726474d062332ee88b

SHA256
2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f

SHA512
7abde54858086a9d16d0cf430d7eb6ec413e259b56ed0e946103f812056a7423db24779e38c2f73fdc7ff047797f2ddf99600708155e03b274a4bd2c1fd58c2e

Download Submit
C:\Windows\8397445313305334\winclfz.exe

Filesize
187KB

MD5
b493b808ebd71c67996645db038807e4

SHA1
8c9bae6be1e3739c3b55a0726474d062332ee88b

SHA256
2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f

SHA512
7abde54858086a9d16d0cf430d7eb6ec413e259b56ed0e946103f812056a7423db24779e38c2f73fdc7ff047797f2ddf99600708155e03b274a4bd2c1fd58c2e

Download Submit
memory/4060-133-0x00000000007E3000-0x00000000007E7000-memory.dmp

Filesize
16KB

Download
memory/4060-134-0x00000000007E3000-0x00000000007E7000-memory.dmp

Filesize
16KB

Download
memory/4060-135-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/4060-139-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/4672-140-0x0000000000602000-0x0000000000606000-memory.dmp

Filesize
16KB

Download
memory/4672-141-0x0000000000602000-0x0000000000606000-memory.dmp

Filesize
16KB

Download
memory/4672-142-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/4672-143-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing