e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b | Triage

Analysis

max time kernel
181s
max time network
202s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 05:01

Sharing

Report Analysis Logs

General

Target

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Size

280KB
MD5

062c777eee936d3b7d4f0eda94298251
SHA1

2dfa19103143f99afd688265a83a08b6aa8794a5
SHA256

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b
SHA512

11fa3efaed4a32f43a24f3e8e20855259a72dd427e7ee744b2a4b26c20b8ccb9edd56056f841dfa0f7c66ffe5bb49d882f57f0729599ac2ef99116e2a519c4a9

Score

1^/10

Malware Config

Signatures

Modifies registry class 18 IoCs

Processes:

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\open\command	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\print\command	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\print	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\printto\command	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\open	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E31F85~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.srl	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E31F85~1.EXE,0"	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E31F85~1.EXE \"%1\""	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srl\ShellNew\NullFile	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\ = "Generi Document"	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\DefaultIcon	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E31F85~1.EXE /p \"%1\""	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\printto	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srl\ = "GenericSerializeDemo.Document"	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.srl\ShellNew	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

pid process

2024 e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

description	pid	process	target process
PID 2024 wrote to memory of 1744	2024	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 2024 wrote to memory of 1744	2024	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 2024 wrote to memory of 1744	2024	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 2024 wrote to memory of 1744	2024	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 2024 wrote to memory of 1744	2024	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 2024 wrote to memory of 1744	2024	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
"C:\Users\Admin\AppData\Local\Temp\e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\wermgr.exe
"C:\Windows\System32\wermgr.exe"
2⤵
PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-56-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/2024-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download