84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3

General

Target

84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Size

56KB
MD5

42fd58c2705d9824457d96db5460aff0
SHA1

981fefd7b4add0d5c4735bd839308a20ed9288aa
SHA256

84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3
SHA512

819951137f1652b1f27d60d516cfceec4847d4e7cdae7277bc4792bf774d8a3389a848acd1db5725f02be58b779dde074d33621affc3b9d2e02b1d2372c7bca8
SSDEEP

768:INdsjQ61yYA9X0bKmIkwf4/tCPwUjRIjaV376:IwPY9XAKeURj6jaV37

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1948 1584 WerFault.exe 84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

pid	pid_target	process	target process
1948	1584	WerFault.exe	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

description	pid	process
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
Token: SeSecurityPrivilege	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

pid process

1584 84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

pid	process
1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe

description	pid	process	target process
PID 1584 wrote to memory of 1948	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe	WerFault.exe
PID 1584 wrote to memory of 1948	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe	WerFault.exe
PID 1584 wrote to memory of 1948	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe	WerFault.exe
PID 1584 wrote to memory of 1948	1584	84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe
"C:\Users\Admin\AppData\Local\Temp\84b618cf8f0f4ba01bbbf04e465abf70ad699c351fb0c63a69c74cdbf98b64a3.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 424
2⤵
- Program crash
PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads