35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf

Analysis

max time kernel
142s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf.exe
Size

63KB
MD5

59c8f56a5d2f7ecb708dc255b28f2951
SHA1

3a888b5e3d98b6c86d62cf15244bde2cf0c885f3
SHA256

35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf
SHA512

982b69d0a744b02b0949000833a0e2f69b4b05eb8288b8a15594af0c3c03ad328ef277a999b26542a48d2fa2c339897a1c8275827c5f0c777fd670dcd54697cd
SSDEEP

1536:+h6MhhIONYFkX2jiQ9AcGxinTlBLyVXO8m0UK2B0DA7s:+h3fpNCr9AGTlZMX/Z2Bfs

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2316	wrm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WRM = "C:\\Windows\\system32\\wrm.exe"	35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wrm.exe	35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf.exe
File opened for modification	C:\Windows\SysWOW64\wrm.exe	35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1804	2316	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf.exe
"C:\Users\Admin\AppData\Local\Temp\35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4740

C:\Windows\SysWOW64\wrm.exe
C:\Windows\SysWOW64\wrm.exe -start
1⤵
- Executes dropped EXE
PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 352
  2⤵
  - Program crash
  PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2316 -ip 2316
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wrm.exe

Filesize
63KB

MD5
59c8f56a5d2f7ecb708dc255b28f2951

SHA1
3a888b5e3d98b6c86d62cf15244bde2cf0c885f3

SHA256
35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf

SHA512
982b69d0a744b02b0949000833a0e2f69b4b05eb8288b8a15594af0c3c03ad328ef277a999b26542a48d2fa2c339897a1c8275827c5f0c777fd670dcd54697cd

Download Submit
C:\Windows\SysWOW64\wrm.exe

Filesize
63KB

MD5
59c8f56a5d2f7ecb708dc255b28f2951

SHA1
3a888b5e3d98b6c86d62cf15244bde2cf0c885f3

SHA256
35ea8f1cc01bc354ee6d30cc7fa586d805e226ff9b9e67fea3b2ac8962e422cf

SHA512
982b69d0a744b02b0949000833a0e2f69b4b05eb8288b8a15594af0c3c03ad328ef277a999b26542a48d2fa2c339897a1c8275827c5f0c777fd670dcd54697cd

Download Submit
memory/2316-136-0x0000000000530000-0x000000000055B000-memory.dmp

Filesize
172KB

Download
memory/2316-137-0x00000000001C0000-0x00000000001E7000-memory.dmp

Filesize
156KB

Download
memory/4740-132-0x0000000000530000-0x000000000055B000-memory.dmp

Filesize
172KB

Download
memory/4740-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download