950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da

Analysis

max time kernel
140s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe
Size

672KB
MD5

6684af5ddae0e1faac8d70180c4d9b70
SHA1

7d85da3ffc446ac16a56221f6cc70facdb657368
SHA256

950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da
SHA512

518df03249009fabc185e0696540b61ff6d1a926539300c9da1f3401987efcd51f69ceb4f4f40e69d506f4d9c31152b35dc68c5d0f2c2ae4051f5e31a2e4ad43
SSDEEP

12288:YyEDqjgIK7FGMUqzjXhX9iU1evbEudwNYsjxiQK1+IPiSu/wOu/WH:KmEV7ZUqn59revbE3Y7QK1+IP

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4392	5088	WerFault.exe	80

Runs .reg file with regedit 1 IoCs

pid	Process
872	regedit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 872	5088	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	81
PID 5088 wrote to memory of 872	5088	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	81
PID 5088 wrote to memory of 872	5088	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	81

C:\Users\Admin\AppData\Local\Temp\950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe
"C:\Users\Admin\AppData\Local\Temp\950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s C:\Users\Admin\AppData\Local\Temp\\chr_extension_inst.reg
  2⤵
  - Runs .reg file with regedit
  PID:872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 1288
  2⤵
  - Program crash
  PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\chr_extension_inst.reg

Filesize
357B

MD5
85994bafd61c8d948cd13194ff774158

SHA1
44ae33e40d0aa91ab6fc04dec6f207af7e24ff64

SHA256
8c6a3aafc42b41dd19a30ad7b4dc8ca1fd941c41f1cc1eba10beff077a59e70b

SHA512
408b30108c41ef1dddbba8585406dea4d72aaef640fb0fec45de14c17fc21c2c651d71f10bccae35b5b4ae1af20d17befedb0ffa5bb48f1de91c186ff14aabc6

Download Submit