c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe
Size

100KB
MD5

f43e306c506b95075994a9edf198791e
SHA1

62e2f760eaa143df1c11de9393bedd58fb457839
SHA256

c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466
SHA512

411b7c4a36fe95878fa9b7087d0b349404996d59b2b154fbdcc4e92577dd908f284ebdf7a6f949f0d4e940ced78bfd6ee2a5cd2f3681c8aba2ee796319b4804e
SSDEEP

3072:aZ/MI7Ehp5/xLUa7e1d7ByNECTWWtBQYs9lxBx:a6MYH/dUa7eD7cEUWWtBA

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe"	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4900-135-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral2/memory/4900-137-0x0000000000400000-0x0000000000439000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Local\Temp\c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe"	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1776	4900	WerFault.exe	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe
3112	4900	WerFault.exe	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe
4696	4900	WerFault.exe	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe
1220	4900	WerFault.exe	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4036 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 4036 taskkill.exe

pid	process
4036	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4036	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe

description	pid	process	target process
PID 4900 wrote to memory of 4036	4900	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe	taskkill.exe
PID 4900 wrote to memory of 4036	4900	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe	taskkill.exe
PID 4900 wrote to memory of 4036	4900	c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe
"C:\Users\Admin\AppData\Local\Temp\c8a4ddd4c2b8363145336257f1e7a9367bc05515ccb7df2e7342c15eedd28466.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM explorer.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 724
2⤵
- Program crash
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 780
2⤵
- Program crash
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 788
2⤵
- Program crash
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 752
2⤵
- Program crash
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4900 -ip 4900
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4900 -ip 4900
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4900 -ip 4900
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4900 -ip 4900
1⤵
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4036-136-0x0000000000000000-mapping.dmp

Download
memory/4900-132-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4900-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4900-134-0x00000000005F0000-0x0000000000629000-memory.dmp

Filesize
228KB

Download
memory/4900-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4900-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4900-138-0x00000000005F0000-0x0000000000629000-memory.dmp

Filesize
228KB

Download