Analysis
- max time kernel
149s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
11/10/2022, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe
- Size 812KB
- Sample221011-jdh62acdgp
- SHA256 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb
- MD5 9362a419bf22dae313dd2df2db1263c1
- SHA1 a35af9c1afc0d948d262ca090d94aee21550dec4
- SHA512 f1c3efb3aeae092638255476d414f5c64fa3b5ec399a96538a925d12ad4ba68bba3395b4bb6b2a1bd48d1bbd4687e559e209e0ef136c59f9a4098b19f74107c0
- SSDEEP 12288:q2iNiUvIYoiZURkkyLjYdtUFADqjJ5nLG/2Ry6EB9fv9zuetSQoEnNwMXlH4qZBG:q18UQYHZI8YdOjrLG
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 4484 1112 WerFault.exe 80 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe - Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1112 34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe"C:\Users\Admin\AppData\Local\Temp\34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 19082⤵
- Program crash
PID:4484
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1112 -ip 11121⤵PID:2040