583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f

Analysis

max time kernel
130s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Size

179KB
MD5

5485adafbbc4ff1d888cf76a3adb8200
SHA1

1096e0169419d08a84b4c88856f2e341cc7a0cc6
SHA256

583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f
SHA512

1fcbce6d82ff9d00f9c630fef2de875f4d8cc91e9906023402fc2308cedbf97468369d987d97abbe93527f341f6984731b992ebed8a0d102accded3d06e28624
SSDEEP

3072:VDzwcnj7u7rVWikKUE7/VRHFzmONl+JlR3+T3Pod7EvSBfr2FaeOt8UqK5Fo/j1v:VDzwcnj67lLVrn8R3+WBSzOt8UqK5K/V

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4988	1708	WerFault.exe	80

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1708	583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe

C:\Users\Admin\AppData\Local\Temp\583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe
"C:\Users\Admin\AppData\Local\Temp\583a03eda6c54d38e7ea578ecfc26ab68392a35b78529b67753c5170254afa8f.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 916
  2⤵
  - Program crash
  PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1708 -ip 1708
1⤵
PID:5072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-132-0x0000000001000000-0x0000000001147000-memory.dmp

Filesize
1.3MB

Download
memory/1708-133-0x0000000001000000-0x0000000001147000-memory.dmp

Filesize
1.3MB

Download