0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb

Analysis

max time kernel
599s
max time network
603s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe
Size

113KB
MD5

7089d78869a3d8e56a9c25d99beace21
SHA1

a8904ead1b344e6bf12368dbb3a151282acc1ebb
SHA256

0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb
SHA512

09de8f75ae3ba42f03200d4795458462ddb7a15154483c7906d55f75558427ff184a0ec58fd477db115d4b64043c6f1ecf5408e571ca6039a26274c244565af2
SSDEEP

3072:BZjg7oWMNfVEwslMwDrgsLLRtQH+TKSY:/YeVEwsRrgEQHOKS

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2860	windrv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\M-505002805264850268057427545920\\windrv.exe"	0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\M-505002805264850268057427545920\\windrv.exe"	0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\M-505002805264850268057427545920\windrv.exe	0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe
File opened for modification	C:\Windows\M-505002805264850268057427545920\windrv.exe	0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe
File opened for modification	C:\Windows\M-505002805264850268057427545920	0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	1436	WerFault.exe	24

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2860	1436	0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe	88
PID 1436 wrote to memory of 2860	1436	0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe	88
PID 1436 wrote to memory of 2860	1436	0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe	88

C:\Users\Admin\AppData\Local\Temp\0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe
"C:\Users\Admin\AppData\Local\Temp\0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\M-505002805264850268057427545920\windrv.exe
  C:\Windows\M-505002805264850268057427545920\windrv.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 860
  2⤵
  - Program crash
  PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1436 -ip 1436
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\M-505002805264850268057427545920\windrv.exe

Filesize
113KB

MD5
7089d78869a3d8e56a9c25d99beace21

SHA1
a8904ead1b344e6bf12368dbb3a151282acc1ebb

SHA256
0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb

SHA512
09de8f75ae3ba42f03200d4795458462ddb7a15154483c7906d55f75558427ff184a0ec58fd477db115d4b64043c6f1ecf5408e571ca6039a26274c244565af2

Download Submit
C:\Windows\M-505002805264850268057427545920\windrv.exe

Filesize
113KB

MD5
7089d78869a3d8e56a9c25d99beace21

SHA1
a8904ead1b344e6bf12368dbb3a151282acc1ebb

SHA256
0e82206694057d79df3f511210307767bea8d1d0c4d4deafb6757fcbceda0fbb

SHA512
09de8f75ae3ba42f03200d4795458462ddb7a15154483c7906d55f75558427ff184a0ec58fd477db115d4b64043c6f1ecf5408e571ca6039a26274c244565af2

Download Submit
memory/1436-132-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1436-133-0x0000000000689000-0x000000000068F000-memory.dmp

Filesize
24KB

Download
memory/1436-134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1436-135-0x0000000000689000-0x000000000068F000-memory.dmp

Filesize
24KB

Download
memory/2860-139-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2860-140-0x00000000006F8000-0x00000000006FE000-memory.dmp

Filesize
24KB

Download
memory/2860-141-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2860-142-0x00000000006F8000-0x00000000006FE000-memory.dmp

Filesize
24KB

Download
memory/2860-143-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download