Analysis
- max time kernel
91s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
13/10/2022, 23:28
Behavioral task
behavioral1
Sample
25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe
- Size 658KB
- Sample221013-3f9ljsaga5
- SHA256 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61
- MD5 6ad07588f4c949ec7b22e82106a48da0
- SHA1 209195aaa3f088f5bf4c8a838b820563a3108cd3
- SHA512 8a90505f6067fa5d691e8f33b668a77458d6cde34e695cc5e6ed2e87a1f12e6a1c9d3597f6ad5becfd77171de71e06ef0305030d512a303df2c135a251f8176a
- SSDEEP 12288:59AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKp:/AQ6Zx9cxTmOrucTIEFSpOGQ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3560 372 WerFault.exe 80 - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeSecurityPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeTakeOwnershipPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeLoadDriverPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeSystemProfilePrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeSystemtimePrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeProfSingleProcessPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeIncBasePriorityPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeCreatePagefilePrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeBackupPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeRestorePrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeShutdownPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeDebugPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeSystemEnvironmentPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeChangeNotifyPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeRemoteShutdownPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeUndockPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeManageVolumePrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeImpersonatePrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: SeCreateGlobalPrivilege 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: 33 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: 34 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: 35 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe Token: 36 372 25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe"C:\Users\Admin\AppData\Local\Temp\25252231c87b33383cc8356f5a7149d8c5714fc9967587e8d93dddc8c2b05b61.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 8402⤵
- Program crash
PID:3560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 372 -ip 3721⤵PID:4492