Analysis
-
max time kernel
69s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-06-2022 22:20
Static task
static1
Behavioral task
behavioral1
Sample
687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe
Resource
win10v2004-20220414-en
General
-
Target
687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe
-
Size
100KB
-
MD5
e1b7edc7b64d3658dc80ff55416b0c13
-
SHA1
dce6acf0d134a7b9a59302624264083a43e0e292
-
SHA256
687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b
-
SHA512
6b86abf8505edfe5e428cb3c3128fa9dd65e4d8bdc0c4b1e1f951733fce66d25e8929150137d2454f77332dc96f6be326a9f9ffe309899fa7ebb731e73f24f81
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
winrvpp.exepid process 4424 winrvpp.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update 495955904 = "C:\\Windows\\7569616913379665\\winrvpp.exe" 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update 495955904 = "C:\\Windows\\7569616913379665\\winrvpp.exe" 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe -
Drops file in Windows directory 3 IoCs
Processes:
687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exedescription ioc process File created C:\Windows\7569616913379665\winrvpp.exe 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe File opened for modification C:\Windows\7569616913379665\winrvpp.exe 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe File opened for modification C:\Windows\7569616913379665 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe -
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4748 4280 WerFault.exe 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe 1476 4280 WerFault.exe 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe 5052 4424 WerFault.exe winrvpp.exe 488 4424 WerFault.exe winrvpp.exe 4644 4280 WerFault.exe 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe 388 4424 WerFault.exe winrvpp.exe 1764 4280 WerFault.exe 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe 4204 4424 WerFault.exe winrvpp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exedescription pid process target process PID 4280 wrote to memory of 4424 4280 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe winrvpp.exe PID 4280 wrote to memory of 4424 4280 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe winrvpp.exe PID 4280 wrote to memory of 4424 4280 687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe winrvpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe"C:\Users\Admin\AppData\Local\Temp\687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\7569616913379665\winrvpp.exeC:\Windows\7569616913379665\winrvpp.exe2⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 5083⤵
- Program crash
PID:5052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 6123⤵
- Program crash
PID:488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 7283⤵
- Program crash
PID:388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 7483⤵
- Program crash
PID:4204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 5522⤵
- Program crash
PID:4748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 6842⤵
- Program crash
PID:1476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 7962⤵
- Program crash
PID:4644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 8042⤵
- Program crash
PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4280 -ip 42801⤵PID:4284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4280 -ip 42801⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4424 -ip 44241⤵PID:4492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4424 -ip 44241⤵PID:3328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4280 -ip 42801⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4424 -ip 44241⤵PID:932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4280 -ip 42801⤵PID:1996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4424 -ip 44241⤵PID:3140
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5e1b7edc7b64d3658dc80ff55416b0c13
SHA1dce6acf0d134a7b9a59302624264083a43e0e292
SHA256687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b
SHA5126b86abf8505edfe5e428cb3c3128fa9dd65e4d8bdc0c4b1e1f951733fce66d25e8929150137d2454f77332dc96f6be326a9f9ffe309899fa7ebb731e73f24f81
-
Filesize
100KB
MD5e1b7edc7b64d3658dc80ff55416b0c13
SHA1dce6acf0d134a7b9a59302624264083a43e0e292
SHA256687d3e649b6ba09bc072fcb69ef751b729983dcdbecfb4da7f0d8b2c509c196b
SHA5126b86abf8505edfe5e428cb3c3128fa9dd65e4d8bdc0c4b1e1f951733fce66d25e8929150137d2454f77332dc96f6be326a9f9ffe309899fa7ebb731e73f24f81