6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a

Analysis

max time kernel
170s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:48

Target

6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe
Size

317KB
MD5

c278cfce93da1486e9fa1e66ba7ddbcb
SHA1

b35c919da92548aea8abf26a46fce91e656c1d7a
SHA256

6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a
SHA512

ba7ac48b1ad0e9b8fe2147818263e467fddd0b44ea376c635d80ab03c311c55a9ef43ef287f84ff828c530328839bf8489798e2aca173c4826048d07f31d9cad
SSDEEP

6144:aq6LJMQFMS3uMlqkIOOrJd8vQssMNtkzmOWkizo/O:aq6VMQmStlqkIOOpMhnhn

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2672 4448 WerFault.exe 6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe

pid	pid_target	process	target process
2672	4448	WerFault.exe	6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe

pid	process
4448	6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe
4448	6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe

description pid process

Token: SeDebugPrivilege 4448 6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe

description	pid	process
Token: SeDebugPrivilege	4448	6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 1616
2⤵
- Program crash
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4448 -ip 4448
1⤵
PID:5016

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/4448-132-0x000000000070D000-0x000000000073E000-memory.dmp

Filesize
196KB

Download
memory/4448-133-0x0000000002260000-0x000000000229E000-memory.dmp

Filesize
248KB

Download
memory/4448-134-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4448-135-0x0000000004D10000-0x00000000052B4000-memory.dmp

Filesize
5.6MB

Download
memory/4448-136-0x0000000005340000-0x00000000053D2000-memory.dmp

Filesize
584KB

Download
memory/4448-137-0x000000000070D000-0x000000000073E000-memory.dmp

Filesize
196KB

Download
memory/4448-138-0x00000000056B0000-0x0000000005CC8000-memory.dmp

Filesize
6.1MB

Download
memory/4448-139-0x00000000054D0000-0x00000000055DA000-memory.dmp

Filesize
1.0MB

Download
memory/4448-140-0x0000000005600000-0x0000000005612000-memory.dmp

Filesize
72KB

Download
memory/4448-141-0x0000000005620000-0x000000000565C000-memory.dmp

Filesize
240KB

Download
memory/4448-142-0x0000000000A00000-0x0000000000A66000-memory.dmp

Filesize
408KB

Download
memory/4448-143-0x0000000006640000-0x0000000006802000-memory.dmp

Filesize
1.8MB

Download
memory/4448-144-0x0000000006810000-0x0000000006D3C000-memory.dmp

Filesize
5.2MB

Download