Analysis

  • max time kernel
    168s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 15:35

General

  • Target

    bd8ba4483e3d8df6071b9cb31de683b87f64e3f1774c9cf5a7ecb76a67a31515.exe

  • Size

    160KB

  • MD5

    c6e6a311f8a988789543683a297aa988

  • SHA1

    4ada699415ece27f75df0fbcd5b9f441c657ef4e

  • SHA256

    bd8ba4483e3d8df6071b9cb31de683b87f64e3f1774c9cf5a7ecb76a67a31515

  • SHA512

    75e731fa841b518079df36fd9b50659b2373ce084412a45ce93c27e21cd6e1cb844520fb29f1b640cf0c5a4444cb9576fd29ade8c0a9c3bd42a8f8289eb333be

  • SSDEEP

    3072:MRAhhcsxgAJuK7bZD01GoI0ONtNmlngmx5MO0xiKlmSaZN:MRAhhJxX7bNIFlxomS0

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Program crash 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd8ba4483e3d8df6071b9cb31de683b87f64e3f1774c9cf5a7ecb76a67a31515.exe
    "C:\Users\Admin\AppData\Local\Temp\bd8ba4483e3d8df6071b9cb31de683b87f64e3f1774c9cf5a7ecb76a67a31515.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 700
      2⤵
      • Program crash
      PID:2764
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 700
      2⤵
      • Program crash
      PID:4576
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3948 -ip 3948
    1⤵
      PID:4596

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2764-133-0x0000000000000000-mapping.dmp

    • memory/3948-132-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB