5c28b949507a6330ec9e768251131e823e1ed1587b5e8913c9e70009f235e9bb

Analysis

max time kernel
238s
max time network
428s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base/RegisterUninstall.exe
Size

7KB
MD5

d7e36dc5c079cd93d8d0a8d33b1819a6
SHA1

f5cf37b37a443e899706d2fe107534e8e8a4a21f
SHA256

4c0758fdf48e8dc3188ba5ff8df7b8c6df4a8d3f7ec5e1843305852a1e1ead2d
SHA512

a4c87d5c648eb14a6ec0e0c30fee893944c45a13511d8ec26b49ec45565002d73ae4b7ec9be6a741ec4cdd5a2b3dcb8ae048c94e65ca7b030943195202f8aa5c
SSDEEP

96:H9kKlfbpxct1GwYseHmmSOUa8B9zaj8dctSMV5RPDtXMbh9WOBjyyJQzNt:iMYzYseHmmSk8Bkt15R5XMbbWfl

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegisterUninstall.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FCcleaner = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FCcleaner.bat"	RegisterUninstall.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1304 2000 WerFault.exe RegisterUninstall.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegisterUninstall.exe

pid process

2000 RegisterUninstall.exe
2000 RegisterUninstall.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegisterUninstall.exe

description pid process

Token: SeDebugPrivilege 2000 RegisterUninstall.exe

pid	pid_target	process	target process
1304	2000	WerFault.exe	RegisterUninstall.exe

pid	process
2000	RegisterUninstall.exe
2000	RegisterUninstall.exe

description	pid	process
Token: SeDebugPrivilege	2000	RegisterUninstall.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

RegisterUninstall.exe

description	pid	process	target process
PID 2000 wrote to memory of 1304	2000	RegisterUninstall.exe	WerFault.exe
PID 2000 wrote to memory of 1304	2000	RegisterUninstall.exe	WerFault.exe
PID 2000 wrote to memory of 1304	2000	RegisterUninstall.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe
"C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2000 -s 1128
  2⤵
  - Program crash
  PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-57-0x0000000000000000-mapping.dmp

Download
memory/2000-54-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download
memory/2000-55-0x0000000000350000-0x0000000000364000-memory.dmp

Filesize
80KB

Download
memory/2000-56-0x00000000020D0000-0x0000000002138000-memory.dmp

Filesize
416KB

Download