d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Size

484KB
MD5

13ffce8662080c941703c4cf419d6344
SHA1

61fc1a13276febbdfe8ec708ebcd25aea28d5a9f
SHA256

d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88
SHA512

445ececa5903c6f07d02997cb72db5d87ae828f5b03751a8112781d1f3ec3ce4c4d2de5a6bbba09ad86e24b5400c145bdb535892f07a148d097692f16b48eb9a
SSDEEP

12288:bMz65QZEomA/fOdveGWeMK2p/VEGbvdVCR8vfy7uv:ozyGP7fOZPWew/VEGZVC6R

Score

3^/10

Malware Config

Signatures

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1636	4864	WerFault.exe	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
908	4864	WerFault.exe	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
1788	4864	WerFault.exe	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe

Modifies registry class 18 IoCs

Processes:

d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D63A2B~1.EXE,0"	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\printto\command	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.max\ = "Matrix.Document"	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\DefaultIcon	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\open	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\print	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D63A2B~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.max	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.max\ShellNew	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\ = "Matrix Document"	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\open\command	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\print\command	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D63A2B~1.EXE /p \"%1\""	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\printto	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Matrix.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D63A2B~1.EXE \"%1\""	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.max\ShellNew\NullFile	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe

pid	process
4864	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
4864	d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe

C:\Users\Admin\AppData\Local\Temp\d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe
"C:\Users\Admin\AppData\Local\Temp\d63a2b5d1008c22d7ad41dbb6f1e31b3447f720bc2740dd0ec4df9b41d023e88.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 532
2⤵
- Program crash
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 540
2⤵
- Program crash
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 540
2⤵
- Program crash
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4864 -ip 4864
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4864 -ip 4864
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4864 -ip 4864
1⤵
PID:3640

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads