Analysis
-
max time kernel
1784s -
max time network
1584s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 06:49
Static task
static1
Behavioral task
behavioral1
Sample
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Resource
win10v2004-20220812-en
General
-
Target
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
-
Size
141KB
-
MD5
048281c0731edf101f02abb1b69a2226
-
SHA1
a6ea5595847d3cbc13c3728c284357bf52a1b945
-
SHA256
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0
-
SHA512
285e6d46f073c8b2aeb67bc938ebf20829cf383961c564a7a5258bcc3bdb66a163ce15c9cc6400ed4a501bf6195e2699f96baa840bcf628f8b94d6b51de6fc85
-
SSDEEP
3072:VNRIUQ7gJGR4AVYZ0Ictpyt28+nqlBB01Qs3wsE:Cg7AVy0Imo8vwsE
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exepid process 4556 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe 4556 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe 4556 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3764 4556 WerFault.exe ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exedescription pid process Token: SeShutdownPrivilege 4556 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Token: SeCreatePagefilePrivilege 4556 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe"C:\Users\Admin\AppData\Local\Temp\ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 13562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4556 -ip 45561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4556-132-0x00000000007BD000-0x00000000007CD000-memory.dmpFilesize
64KB
-
memory/4556-133-0x00000000006D0000-0x00000000006E2000-memory.dmpFilesize
72KB
-
memory/4556-134-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/4556-135-0x0000000002F50000-0x0000000002F57000-memory.dmpFilesize
28KB
-
memory/4556-136-0x000000007FE30000-0x000000007FE45000-memory.dmpFilesize
84KB
-
memory/4556-137-0x00000000007BD000-0x00000000007CD000-memory.dmpFilesize
64KB
-
memory/4556-138-0x00000000006D0000-0x00000000006E2000-memory.dmpFilesize
72KB
-
memory/4556-139-0x000000007FE30000-0x000000007FE45000-memory.dmpFilesize
84KB
-
memory/4556-140-0x00000000035F0000-0x00000000045F0000-memory.dmpFilesize
16.0MB
-
memory/4556-141-0x0000000002F50000-0x0000000002F57000-memory.dmpFilesize
28KB
-
memory/4556-142-0x000000007FE10000-0x000000007FE25000-memory.dmpFilesize
84KB
-
memory/4556-143-0x000000007FE30000-0x000000007FE45000-memory.dmpFilesize
84KB