43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8

General

Target

43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
Size

597KB
MD5

b476f8f28b54b658e2491a528857c414
SHA1

12c251626673c0b341a565896f8461028b8e5ccd
SHA256

43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8
SHA512

ff852708ad1660d65dacc6af80f78d5be7e6384127121dbbf37cc7b710e44a84bb0c7a560f1c2716b23c578d7fcb02257842abd8f0cd89209825d3f02e684329
SSDEEP

12288:QLZVLFfktpfuYh8RAywcYQ6bY0AsgqPKspkci7oIRmouFwwWJCvkA:KFSpZhylwdQexAv1sphi8+0vkA

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1748	2176	WerFault.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
3976	3896	WerFault.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
3480	2744	WerFault.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\ 43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

pid	process
2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

Suspicious use of UnmapMainImage 3 IoCs

Processes:

43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

pid	process
2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
3896	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
2744	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

description	pid	process	target process
PID 2176 wrote to memory of 2744	2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
PID 2176 wrote to memory of 2744	2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
PID 2176 wrote to memory of 2744	2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
PID 2176 wrote to memory of 3896	2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
PID 2176 wrote to memory of 3896	2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
PID 2176 wrote to memory of 3896	2176	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe	43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe

C:\Users\Admin\AppData\Local\Temp\43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
"C:\Users\Admin\AppData\Local\Temp\43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 500
2⤵
- Program crash
PID:1748

C:\Users\Admin\AppData\Local\Temp\43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
start
2⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious use of UnmapMainImage
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 492
3⤵
- Program crash
PID:3480

C:\Users\Admin\AppData\Local\Temp\43bde314ff1575615f3532a4d9fc78b14db5f1f6b858c6cdac4e3260137d82f8.exe
watch
2⤵
- Suspicious use of UnmapMainImage
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 500
3⤵
- Program crash
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2176 -ip 2176
1⤵
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2744 -ip 2744
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3896 -ip 3896
1⤵
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-132-0x000000007FE30000-0x000000007FE49000-memory.dmp

Filesize
100KB

Download
memory/2176-133-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2176-136-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2744-134-0x0000000000000000-mapping.dmp

Download
memory/2744-137-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2744-140-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3896-135-0x0000000000000000-mapping.dmp

Download
memory/3896-138-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3896-139-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3896-141-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads