ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a

Analysis

max time kernel
64s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2022 15:21

Target

ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe
Size

428KB
MD5

c63e4269092b0850b7fca86e1e13d4b5
SHA1

8c70bec3dbf3c2194f50d740ecba1c840852967e
SHA256

ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a
SHA512

20dd67006bacf1a5dc3f8b7fe71618ddadb3583fc29e2d82f4bb40362fee83a17ba525f675f3838c89962582c4451f21ee9f0b4c5ba5db3b9ef604a5a0457454
SSDEEP

6144:jHxKLBQOKKhiqyZuCsyN3r7qkwhKXuh07e6tWg1YYVnhqyC/LjzEndTQ:jHoFQOKuPusyN3UKXB7e6tWchQvUdT

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 2384 WerFault.exe ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe

pid	pid_target	process	target process
2800	2384	WerFault.exe	ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe

pid	process
2384	ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe
2384	ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe

description pid process

Token: SeDebugPrivilege 2384 ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe

description	pid	process
Token: SeDebugPrivilege	2384	ca2d4679f79af15419f615d23db7f55e89e7fd348c0cd082726e8742b1b4906a.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1952
2⤵
- Program crash
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2384 -ip 2384
1⤵
PID:2996

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/2384-133-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/2384-134-0x0000000002490000-0x00000000024E9000-memory.dmp

Filesize
356KB

Download
memory/2384-135-0x0000000000400000-0x000000000086E000-memory.dmp

Filesize
4.4MB

Download
memory/2384-136-0x0000000005110000-0x00000000056B4000-memory.dmp

Filesize
5.6MB

Download
memory/2384-137-0x00000000056C0000-0x0000000005CD8000-memory.dmp

Filesize
6.1MB

Download
memory/2384-138-0x0000000002AE0000-0x0000000002AF2000-memory.dmp

Filesize
72KB

Download
memory/2384-139-0x0000000004FB0000-0x00000000050BA000-memory.dmp

Filesize
1.0MB

Download
memory/2384-140-0x0000000002B00000-0x0000000002B3C000-memory.dmp

Filesize
240KB

Download
memory/2384-141-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/2384-142-0x0000000006640000-0x00000000066D2000-memory.dmp

Filesize
584KB

Download
memory/2384-143-0x00000000066E0000-0x0000000006756000-memory.dmp

Filesize
472KB

Download
memory/2384-144-0x0000000006790000-0x00000000067AE000-memory.dmp

Filesize
120KB

Download
memory/2384-145-0x0000000006950000-0x0000000006B12000-memory.dmp

Filesize
1.8MB

Download
memory/2384-146-0x0000000006B30000-0x000000000705C000-memory.dmp

Filesize
5.2MB

Download
memory/2384-147-0x0000000000400000-0x000000000086E000-memory.dmp

Filesize
4.4MB

Download