2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8

Analysis

max time kernel
182s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe
Size

6.3MB
MD5

8bf1275aaa6a8988bcc24ce6633e1265
SHA1

625e0cb618cb00be7b1395c066aa58b0a731b7ae
SHA256

2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8
SHA512

b3707cb6d3f7f315c3822285d24816a5d9939cbf52cc0b96addff1e3993e92032131d6c56feba26f9d1d99cee7d32c27a2f64a92a430a9e384b6d46026c7ee1f
SSDEEP

98304:SgenqebzWpF8Kk6gLkAnSJ5ohRskJNNgPNpmOkgl+sHFZZC1zBqouXc:SDnKpFdOwAnSJ5WRsH3mul+Mg9F

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogin.exe"	2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2840 3752 WerFault.exe 2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe

pid process

3752 2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe

pid	pid_target	process	target process
2840	3752	WerFault.exe	2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe

pid	process
3752	2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe

C:\Users\Admin\AppData\Local\Temp\2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe
"C:\Users\Admin\AppData\Local\Temp\2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:3752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 380
  2⤵
  - Program crash
  PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3752 -ip 3752
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3752-132-0x0000000000400000-0x0000000001183D9A-memory.dmp

Filesize
13.5MB

Download
memory/3752-133-0x0000000000400000-0x0000000001183D9A-memory.dmp

Filesize
13.5MB

Download