343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56

Analysis

max time kernel
35s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe
Size

56KB
MD5

0b9c1f968f404134eea415ca658ae4aa
SHA1

63b782e7ee953ed909e78d13ed255daef91a846e
SHA256

343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56
SHA512

36a0ae6b78a6676e17bdf6717016cc426d813f50e3587f81ec63baf69862431e202729599a70a7bebeb1214b51cde4a5a5cdb1b203bb7121eb72cf0060666514
SSDEEP

1536:Qgk0lJWdVExI1hY6CDUDQSC+gk0lJWdVExI1hY6CDUDQSqQ:q0lmVQI1hYrunCo0lmVQI1hYrunqQ

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4616	ntldr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NT4 hosting service = "C:\\Windows\\system32\\ntldr.exe"	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ntldr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NT4 hosting service = "C:\\Windows\\system32\\ntldr.exe"	ntldr.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RCXEB01.tmp	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe
File opened for modification	C:\Windows\SysWOW64\ntldr.exe	ntldr.exe
File created	C:\Windows\SysWOW64\ntldr.exe	ntldr.exe
File opened for modification	C:\Windows\SysWOW64\ntldr.exe	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe
File created	C:\Windows\SysWOW64\ntldr.exe	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5044	4616	WerFault.exe	81
4928	620	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 4616	620	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe	81
PID 620 wrote to memory of 4616	620	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe	81
PID 620 wrote to memory of 4616	620	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe	81

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ntldr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveAutoRun = "0"	ntldr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "0"	ntldr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveAutoRun = "0"	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "0"	343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe

C:\Users\Admin\AppData\Local\Temp\343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe
"C:\Users\Admin\AppData\Local\Temp\343fd75cc563092616b48e1cad539096fc8250edbefa33f9671b02ca8545aa56.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:620
- C:\Windows\SysWOW64\ntldr.exe
  "C:\Windows\system32\ntldr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System policy modification
  PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 344
    3⤵
    - Program crash
    PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 360
  2⤵
  - Program crash
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4616 -ip 4616
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 620 -ip 620
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ntldr.exe

Filesize
24KB

MD5
45d6e9d9640bbe2647d907e543b5cfb3

SHA1
f343dcc032f7c287b1f7c47d75280e961c579129

SHA256
d81b6465f323347d3474e4a89d4da28f750ec106554e57729def2e2be07062cc

SHA512
608759a95bc6375c677e32486b41d15d6c5d9f9a5b7e2623d1331d13eea982786dfeae17da4b576b504e8419f833e3789d185898ae067eafe5286b0069c97f9f

Download Submit
C:\Windows\SysWOW64\ntldr.exe

Filesize
24KB

MD5
45d6e9d9640bbe2647d907e543b5cfb3

SHA1
f343dcc032f7c287b1f7c47d75280e961c579129

SHA256
d81b6465f323347d3474e4a89d4da28f750ec106554e57729def2e2be07062cc

SHA512
608759a95bc6375c677e32486b41d15d6c5d9f9a5b7e2623d1331d13eea982786dfeae17da4b576b504e8419f833e3789d185898ae067eafe5286b0069c97f9f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads