Overview

overview

10

Static

static

1f3ca75345...91.exe

windows7-x64

10

1f3ca75345...91.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 08:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1f3ca75345e13e39abe198396e426aa0b5173e86c58df30eb6cf25c716791591.exe

  • Size

    475KB

  • MD5

    6cc60d6eabd2d207e06db5e0cf45fec0

  • SHA1

    2668b1fce359d9ab72ae1be5ba9ab290c7655a5c

  • SHA256

    1f3ca75345e13e39abe198396e426aa0b5173e86c58df30eb6cf25c716791591

  • SHA512

    7295fd3a983d7f9a5fe8483e1c81414e43cc69f75014684df3b109043f227026aba12083b28ad71fe820b8cf8811c13e57ad1cb572ab0ec8e5cf7b6bd6e5b7bf

  • SSDEEP

    6144:6WePyhh4BAi1ddWt8Bsqvdo0Y4VTC3W3M9aH11CQOd3nt7miFyneN+1n60FSppdm:QyhiV68m8/JTC3GCQ297z8C+nF0m

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables taskbar notifications via registry modification
    evasion
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Program crash 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f3ca75345e13e39abe198396e426aa0b5173e86c58df30eb6cf25c716791591.exe
    "C:\Users\Admin\AppData\Local\Temp\1f3ca75345e13e39abe198396e426aa0b5173e86c58df30eb6cf25c716791591.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • System policy modification
    PID:2116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 544
      2⤵
      • Program crash
      PID:2580
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 676
      2⤵
      • Program crash
      PID:3972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 696
      2⤵
      • Program crash
      PID:3828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 704
      2⤵
      • Program crash
      PID:528
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 676
      2⤵
      • Program crash
      PID:4748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 692
      2⤵
      • Program crash
      PID:4520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 696
      2⤵
      • Program crash
      PID:876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 828
      2⤵
      • Program crash
      PID:3872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1020
      2⤵
      • Program crash
      PID:4760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1028
      2⤵
      • Program crash
      PID:4784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1000
      2⤵
      • Program crash
      PID:4476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 784
      2⤵
      • Program crash
      PID:3528
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1348
      2⤵
      • Program crash
      PID:2332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 956
      2⤵
      • Program crash
      PID:1192
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2116 -ip 2116
    1⤵
      PID:2236
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2116 -ip 2116
      1⤵
        PID:2784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2116 -ip 2116
        1⤵
          PID:1276
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2116 -ip 2116
          1⤵
            PID:212
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2116 -ip 2116
            1⤵
              PID:3080
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2116 -ip 2116
              1⤵
                PID:3116
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2116 -ip 2116
                1⤵
                  PID:1296
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2116 -ip 2116
                  1⤵
                    PID:4800
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2116 -ip 2116
                    1⤵
                      PID:4412
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2116 -ip 2116
                      1⤵
                        PID:4688
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2116 -ip 2116
                        1⤵
                          PID:2584
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2116 -ip 2116
                          1⤵
                            PID:1424
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2116 -ip 2116
                            1⤵
                              PID:2984
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2116 -ip 2116
                              1⤵
                                PID:2912

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • memory/2116-132-0x0000000000400000-0x000000000147E000-memory.dmp

                                Filesize

                                16.5MB

                                Download

                              • memory/2116-133-0x0000000001610000-0x0000000001613000-memory.dmp

                                Filesize

                                12KB

                                Download

                              • memory/2116-134-0x0000000000400000-0x000000000147E000-memory.dmp

                                Filesize

                                16.5MB

                                Download