c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
Size

237KB
MD5

812e1c82f7ff475fc940f33e6ef5d4ba
SHA1

dfdb04d398d101648453a96bf3b1ee9a99f7ee88
SHA256

c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc
SHA512

1733de0d696f7cd805fc020aeada4ff4f87bec733110c9d01a12b631a0198847caf922270a352a69fd4ec8ed7f87d5f93edc9fc8fb924924bc2c3e8d8fee3a61
SSDEEP

768:jZKM11gG4ChfiPO0rfz0shcUypMC5/VKhZyg3ini2L2o27+IpF7wy4Vo2f:gMDgG4ChfiPOefgsOUqQwgU

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System applets = "C:\\Windows\\System\\applets.exe"	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Syssrc32 = "C:\\Windows\\Syssrc32.exe"	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fndfst32 = "C:\\Windows\\System\\fndfst32.exe"	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer Shell = "C:\\Windows\\System\\Explorer.exe"	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Help\intret.cnt	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File created	C:\Windows\Syssrc32.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File opened for modification	C:\Windows\System\fndfst32.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File opened for modification	C:\Windows\System\Explorer.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File created	C:\Windows\System\Sysexp32.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File opened for modification	C:\Windows\Syssrc32.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File opened for modification	C:\Windows\System\Sysexp32.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File created	C:\Windows\System\mplayerw.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File created	C:\Windows\System\applets.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File opened for modification	C:\Windows\Help\intret.cnt	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File opened for modification	C:\Windows\System\mplayerw.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File opened for modification	C:\Windows\System\applets.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File created	C:\Windows\System\fndfst32.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
File created	C:\Windows\System\Explorer.exe	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5060	1236	WerFault.exe	81

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\Explore = "%SystemRoot%\\SysWow64\\NOTEPAD.EXE %1"	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\System\\Sysexp32.exe %1"	c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe

C:\Users\Admin\AppData\Local\Temp\c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe
"C:\Users\Admin\AppData\Local\Temp\c3af7cdb8942e3c3332600b84b2fe5190da5d74d5704ee09a611dd05c9efc7dc.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:1236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 304
  2⤵
  - Program crash
  PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1236 -ip 1236
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads