fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 10:31

Target

fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
Size

1.5MB
MD5

6fa0f13914affbe3f7540a2426bb5d19
SHA1

686d72dac9e3f46185dc7a844639b5ec7d53adea
SHA256

fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942
SHA512

cb070b30131434e22db994c1c845d1e5c3332a9310177e16c6f6cdd8a836bd6d8c4bf88f190f2bfee9004dd5e9b7270f27026265344701ea1db74f4a7898a8bd
SSDEEP

49152:M9MJrnLf+6humwV0oFfK50mmQeZyMyKwJD:M9MVrta7I5HQMowJD

Score

7^/10

discovery

Loads dropped DLL 1 IoCs

pid	Process
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	2424	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
2424	fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe

C:\Users\Admin\AppData\Local\Temp\fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe
"C:\Users\Admin\AppData\Local\Temp\fdec7854156cbf5a2309ea862aaf6633e793e1281ed42b7c0e898d95b8db8942.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 1184
  2⤵
  - Program crash
  PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2424 -ip 2424
1⤵
PID:4072

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\112415578152\LZMA.dll

Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit