e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
Size

685KB
MD5

bdc4a8ef0f9adbd1253b48aba70167ae
SHA1

6b081505de57ec8668ce7b63873510b1f024551a
SHA256

e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af
SHA512

a62c68896d885e0aed2821b26133358b082289151f04f069507f021eb34876e760f1d9ac9a1ffdf03511735845a187a5fd775216b7dedb15eeb2a47efef9e930
SSDEEP

12288:5KsrW5aEx8uX+TJ8tXYk4dHct2CAKsw1UBKhm2m+dLPwe4gMSGEj0xLpUk:AsrI8uAXZct2zKtUBKAn+LPwePGV

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1340 1844 WerFault.exe e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe

description pid process

Token: SeDebugPrivilege 1844 e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe

pid	pid_target	process	target process
1340	1844	WerFault.exe	e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe

description	pid	process
Token: SeDebugPrivilege	1844	e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe

description	pid	process	target process
PID 1844 wrote to memory of 1340	1844	e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe	WerFault.exe
PID 1844 wrote to memory of 1340	1844	e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe	WerFault.exe
PID 1844 wrote to memory of 1340	1844	e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
"C:\Users\Admin\AppData\Local\Temp\e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1844 -s 1040
2⤵
- Program crash
PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-59-0x0000000000000000-mapping.dmp

Download
memory/1844-54-0x0000000000280000-0x0000000000330000-memory.dmp

Filesize
704KB

Download
memory/1844-55-0x000000001AFA0000-0x000000001B07E000-memory.dmp

Filesize
888KB

Download
memory/1844-56-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1844-57-0x000000001A790000-0x000000001A810000-memory.dmp

Filesize
512KB

Download
memory/1844-58-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/1844-60-0x000000001A790000-0x000000001A810000-memory.dmp

Filesize
512KB

Download