61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
Size

641KB
MD5

20d469ae06ffceb327eecd5a03855cf0
SHA1

5e025a1461d7bde5b5901270135865cb8b5f6809
SHA256

61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede
SHA512

d623ef1298e6b4233fc7b76b165eb50f0579bde268bcfa0d29e4d06652c503ba23ca27e3924a21adb423fc0e8b74433fffc941f9a4a1cde22a1b99b9c4ae38e2
SSDEEP

12288:AFkDklOJ1ZNs+0FNP0K/Ejpv4sNB07UzhFdIL2IG7DzgX8FYg6V:P4lOJbi+0/0K/Ex4qB07UzndK2pYXngm

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1388	5040	WerFault.exe	82
2160	1488	WerFault.exe	85
3668	1400	WerFault.exe	86

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
1488	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
1400	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 1488	5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe	85
PID 5040 wrote to memory of 1488	5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe	85
PID 5040 wrote to memory of 1488	5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe	85
PID 5040 wrote to memory of 1400	5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe	86
PID 5040 wrote to memory of 1400	5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe	86
PID 5040 wrote to memory of 1400	5040	61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe	86

C:\Users\Admin\AppData\Local\Temp\61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
"C:\Users\Admin\AppData\Local\Temp\61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 500
  2⤵
  - Program crash
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
  start
  2⤵
  - Checks BIOS information in registry
  - Enumerates system info in registry
  - Suspicious use of UnmapMainImage
  PID:1488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 496
    3⤵
    - Program crash
    PID:2160
- C:\Users\Admin\AppData\Local\Temp\61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 504
    3⤵
    - Program crash
    PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5040 -ip 5040
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1488 -ip 1488
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1400 -ip 1400
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-138-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1400-140-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1488-137-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1488-139-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/5040-132-0x000000007FE30000-0x000000007FE49000-memory.dmp

Filesize
100KB

Download
memory/5040-133-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/5040-136-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download