9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3

Analysis

max time kernel
103s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe
Size

625KB
MD5

a570ca83b9d5580f0a81c89d5243c4b6
SHA1

2e815bb9471410fa9055e2a006d143fe666ebcf4
SHA256

9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3
SHA512

dbce44c719e0bc12ade5cf6dd1e1b300666907173dcac9a5d3648753b6dc2b58ee8a86133e5f8d8d6c944f58b03f693b74dc54b157d1a2ebc82d3299c72a6342
SSDEEP

12288:CM5h2Jzjn/0UpAymAHD60hTN+eqZxQIxGTq5VA+:o/vpdmAHDNwnxQAQEm+

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4860	1376	WerFault.exe	78
2068	4064	WerFault.exe	82
4040	4388	WerFault.exe	83

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe
1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe
4064	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe
4388	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 4064	1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe	82
PID 1376 wrote to memory of 4064	1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe	82
PID 1376 wrote to memory of 4064	1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe	82
PID 1376 wrote to memory of 4388	1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe	83
PID 1376 wrote to memory of 4388	1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe	83
PID 1376 wrote to memory of 4388	1376	9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe	83

C:\Users\Admin\AppData\Local\Temp\9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe
"C:\Users\Admin\AppData\Local\Temp\9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 556
  2⤵
  - Program crash
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe
  start
  2⤵
  - Checks BIOS information in registry
  - Enumerates system info in registry
  - Suspicious use of UnmapMainImage
  PID:4064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 572
    3⤵
    - Program crash
    PID:2068
- C:\Users\Admin\AppData\Local\Temp\9e6e4098e7c394599a8ee8f41037685830263228272691c4f59aeda4aeb6ffa3.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:4388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 560
    3⤵
    - Program crash
    PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1376 -ip 1376
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4064 -ip 4064
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4388 -ip 4388
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-132-0x00000000021F0000-0x000000000220F000-memory.dmp

Filesize
124KB

Download
memory/1376-133-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1376-136-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4064-137-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4064-139-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4064-141-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4388-138-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4388-140-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4388-142-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download