136a3fe7a346af689bd3b550aa4947c9e180bc49027b5600ce8276e6f5fdf743

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2022 18:49

Target

f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe
Size

354KB
MD5

c19597e6f88306fbbc06cd0dadfd7452
SHA1

f943847242914326548980fdd724547e5aea31b1
SHA256

f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14
SHA512

14884470ad999fd0ec519ea9bdc3fa2e4e2a2e1b00b4d53242ab04219ff367230b2cb028606603f29b6ac6e8e8e55e122b644c95d44443001c3aded1d2f805ee

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5024 4716 WerFault.exe f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe

pid	pid_target	process	target process
5024	4716	WerFault.exe	f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe

pid	process
4716	f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe
4716	f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe

description pid process

Token: SeDebugPrivilege 4716 f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe

description	pid	process
Token: SeDebugPrivilege	4716	f9ed745668a3a1b10b2531cb51d8d22f19250d09fa01bd36b5d8756cb8b8bc14.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 1876
2⤵
- Program crash
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4716 -ip 4716
1⤵
PID:2768

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/4716-130-0x0000000006C40000-0x00000000071E4000-memory.dmp

Filesize
5.6MB

Download
memory/4716-131-0x0000000002688000-0x00000000026B2000-memory.dmp

Filesize
168KB

Download
memory/4716-132-0x0000000002630000-0x0000000002668000-memory.dmp

Filesize
224KB

Download
memory/4716-133-0x0000000000400000-0x00000000024DE000-memory.dmp

Filesize
32.9MB

Download
memory/4716-134-0x0000000007260000-0x0000000007878000-memory.dmp

Filesize
6.1MB

Download
memory/4716-135-0x00000000078E0000-0x00000000078F2000-memory.dmp

Filesize
72KB

Download
memory/4716-136-0x0000000007900000-0x0000000007A0A000-memory.dmp

Filesize
1.0MB

Download
memory/4716-137-0x0000000007A30000-0x0000000007A6C000-memory.dmp

Filesize
240KB

Download
memory/4716-138-0x0000000007D30000-0x0000000007DC2000-memory.dmp

Filesize
584KB

Download
memory/4716-139-0x0000000007DD0000-0x0000000007E46000-memory.dmp

Filesize
472KB

Download
memory/4716-140-0x0000000007ED0000-0x0000000007EEE000-memory.dmp

Filesize
120KB

Download
memory/4716-141-0x00000000080B0000-0x0000000008116000-memory.dmp

Filesize
408KB

Download
memory/4716-142-0x0000000008890000-0x0000000008A52000-memory.dmp

Filesize
1.8MB

Download
memory/4716-143-0x0000000008A90000-0x0000000008FBC000-memory.dmp

Filesize
5.2MB

Download
memory/4716-144-0x0000000000400000-0x00000000024DE000-memory.dmp

Filesize
32.9MB

Download