Analysis
-
max time kernel
259s -
max time network
331s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe
Resource
win10v2004-20221111-en
General
-
Target
864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe
-
Size
124KB
-
MD5
271a265825af40f9ccd5243a1e4fe275
-
SHA1
9394e716634dceeb654423cd95a9c9716725f0ac
-
SHA256
864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5
-
SHA512
ac1997d299ef7b2c6720b824392239f57b9d6d744197deccdb850926d39460f4ff879a38a99b5a3496a26cf0fbdc8e901ba0ea81996a0b20685a115bd226de96
-
SSDEEP
3072:8cEE9t/0FZ3N68DfKrCAhh1m5fBC2dCiuN/:cFZ3N68DfUPt23G/
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
taskhost.exetaskhost.exepid process 2068 taskhost.exe 3388 taskhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Taskhost = "C:\\Users\\Admin\\AppData\\Roaming\\taskhost.exe" 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exetaskhost.exedescription pid process target process PID 4676 set thread context of 744 4676 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe PID 2068 set thread context of 3388 2068 taskhost.exe taskhost.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4312 4676 WerFault.exe 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe 4508 2068 WerFault.exe taskhost.exe 4796 2068 WerFault.exe taskhost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exetaskhost.exedescription pid process target process PID 4676 wrote to memory of 744 4676 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe PID 4676 wrote to memory of 744 4676 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe PID 4676 wrote to memory of 744 4676 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe PID 4676 wrote to memory of 744 4676 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe PID 4676 wrote to memory of 744 4676 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe PID 744 wrote to memory of 2068 744 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe taskhost.exe PID 744 wrote to memory of 2068 744 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe taskhost.exe PID 744 wrote to memory of 2068 744 864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe taskhost.exe PID 2068 wrote to memory of 3388 2068 taskhost.exe taskhost.exe PID 2068 wrote to memory of 3388 2068 taskhost.exe taskhost.exe PID 2068 wrote to memory of 3388 2068 taskhost.exe taskhost.exe PID 2068 wrote to memory of 3388 2068 taskhost.exe taskhost.exe PID 2068 wrote to memory of 3388 2068 taskhost.exe taskhost.exe PID 2068 wrote to memory of 4796 2068 taskhost.exe WerFault.exe PID 2068 wrote to memory of 4796 2068 taskhost.exe WerFault.exe PID 2068 wrote to memory of 4796 2068 taskhost.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe"C:\Users\Admin\AppData\Local\Temp\864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exeC:\Users\Admin\AppData\Local\Temp\864d8a6d5318eea7dc89ec864013fd33ee4d9f8d45f4bac2cade829362cc43e5.exe2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskhost.exeC:\Users\Admin\AppData\Roaming\taskhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskhost.exeC:\Users\Admin\AppData\Roaming\taskhost.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 3924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 3924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 4002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4676 -ip 46761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2068 -ip 20681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\taskhost.exeFilesize
124KB
MD58150c2abc47144b9cd539a1121f3e18b
SHA1bc1a194a34d1fae7a496df95566d300d297936f5
SHA25670645c3816c086a4afcd535ace7f87795cd59ae4a4b7e7364afa47def3d26e43
SHA512a90a32c889236103315e2d8feb32e2d9f87f851107e0b715878e6b81cc42070061e1a12b9c17acfbd134c9485f414b9a47289061d69bd0197debc33710cbcd04
-
C:\Users\Admin\AppData\Roaming\taskhost.exeFilesize
124KB
MD58150c2abc47144b9cd539a1121f3e18b
SHA1bc1a194a34d1fae7a496df95566d300d297936f5
SHA25670645c3816c086a4afcd535ace7f87795cd59ae4a4b7e7364afa47def3d26e43
SHA512a90a32c889236103315e2d8feb32e2d9f87f851107e0b715878e6b81cc42070061e1a12b9c17acfbd134c9485f414b9a47289061d69bd0197debc33710cbcd04
-
C:\Users\Admin\AppData\Roaming\taskhost.exeFilesize
124KB
MD58150c2abc47144b9cd539a1121f3e18b
SHA1bc1a194a34d1fae7a496df95566d300d297936f5
SHA25670645c3816c086a4afcd535ace7f87795cd59ae4a4b7e7364afa47def3d26e43
SHA512a90a32c889236103315e2d8feb32e2d9f87f851107e0b715878e6b81cc42070061e1a12b9c17acfbd134c9485f414b9a47289061d69bd0197debc33710cbcd04
-
memory/744-146-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/744-133-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/744-134-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/744-135-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/744-136-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/744-132-0x0000000000000000-mapping.dmp
-
memory/2068-137-0x0000000000000000-mapping.dmp
-
memory/3388-140-0x0000000000000000-mapping.dmp
-
memory/3388-144-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3388-145-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3388-143-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3388-148-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4796-147-0x0000000000000000-mapping.dmp