bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6

General

Target

bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe
Size

134KB
MD5

99a307128daa407147d1c69d2824d703
SHA1

2e3e8a3454262016d1d453c702a0dc8b42e29d5f
SHA256

bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6
SHA512

06dd4db7a2664f66c5c8340aae5ee4b7cd928e20a02bb1451db868ea36159d6a5f4901fa881631ca6d9bd0ec290fc36c04be90c3cc75cb164ea2a247549add64
SSDEEP

3072:YRtkipdQ9dsMMIPM0tMspHOpwYxwcOiXclV:GKlt3HMwItOi

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

adobeflash.exe

pid process

1632 adobeflash.exe
Deletes itself 1 IoCs

Processes:

adobeflash.exe

pid process

1632 adobeflash.exe

pid	process
1632	adobeflash.exe

pid	process
1632	adobeflash.exe

Loads dropped DLL 6 IoCs

Processes:

bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exeWerFault.exe

pid	process
1668	bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe
1668	bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\adobeflash = "C:\\Users\\Admin\\AppData\\Roaming\\adobeflash.exe"	bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1784 1632 WerFault.exe adobeflash.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

adobeflash.exe

description pid process

Token: SeDebugPrivilege 1632 adobeflash.exe

pid	pid_target	process	target process
1784	1632	WerFault.exe	adobeflash.exe

description	pid	process
Token: SeDebugPrivilege	1632	adobeflash.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exeadobeflash.exe

description	pid	process	target process
PID 1668 wrote to memory of 1632	1668	bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe	adobeflash.exe
PID 1668 wrote to memory of 1632	1668	bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe	adobeflash.exe
PID 1668 wrote to memory of 1632	1668	bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe	adobeflash.exe
PID 1668 wrote to memory of 1632	1668	bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe	adobeflash.exe
PID 1632 wrote to memory of 1784	1632	adobeflash.exe	WerFault.exe
PID 1632 wrote to memory of 1784	1632	adobeflash.exe	WerFault.exe
PID 1632 wrote to memory of 1784	1632	adobeflash.exe	WerFault.exe
PID 1632 wrote to memory of 1784	1632	adobeflash.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe
"C:\Users\Admin\AppData\Local\Temp\bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Roaming\adobeflash.exe
alina=C:\Users\Admin\AppData\Local\Temp\bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6.exe
2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 1016
3⤵
- Loads dropped DLL
- Program crash
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\adobeflash.exe
Filesize
134KB

MD5
99a307128daa407147d1c69d2824d703

SHA1
2e3e8a3454262016d1d453c702a0dc8b42e29d5f

SHA256
bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6

SHA512
06dd4db7a2664f66c5c8340aae5ee4b7cd928e20a02bb1451db868ea36159d6a5f4901fa881631ca6d9bd0ec290fc36c04be90c3cc75cb164ea2a247549add64

Download Submit
\Users\Admin\AppData\Roaming\adobeflash.exe
Filesize
134KB

MD5
99a307128daa407147d1c69d2824d703

SHA1
2e3e8a3454262016d1d453c702a0dc8b42e29d5f

SHA256
bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6

SHA512
06dd4db7a2664f66c5c8340aae5ee4b7cd928e20a02bb1451db868ea36159d6a5f4901fa881631ca6d9bd0ec290fc36c04be90c3cc75cb164ea2a247549add64

Download Submit
\Users\Admin\AppData\Roaming\adobeflash.exe
Filesize
134KB

MD5
99a307128daa407147d1c69d2824d703

SHA1
2e3e8a3454262016d1d453c702a0dc8b42e29d5f

SHA256
bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6

SHA512
06dd4db7a2664f66c5c8340aae5ee4b7cd928e20a02bb1451db868ea36159d6a5f4901fa881631ca6d9bd0ec290fc36c04be90c3cc75cb164ea2a247549add64

Download Submit
\Users\Admin\AppData\Roaming\adobeflash.exe
Filesize
134KB

MD5
99a307128daa407147d1c69d2824d703

SHA1
2e3e8a3454262016d1d453c702a0dc8b42e29d5f

SHA256
bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6

SHA512
06dd4db7a2664f66c5c8340aae5ee4b7cd928e20a02bb1451db868ea36159d6a5f4901fa881631ca6d9bd0ec290fc36c04be90c3cc75cb164ea2a247549add64

Download Submit
\Users\Admin\AppData\Roaming\adobeflash.exe
Filesize
134KB

MD5
99a307128daa407147d1c69d2824d703

SHA1
2e3e8a3454262016d1d453c702a0dc8b42e29d5f

SHA256
bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6

SHA512
06dd4db7a2664f66c5c8340aae5ee4b7cd928e20a02bb1451db868ea36159d6a5f4901fa881631ca6d9bd0ec290fc36c04be90c3cc75cb164ea2a247549add64

Download Submit
\Users\Admin\AppData\Roaming\adobeflash.exe
Filesize
134KB

MD5
99a307128daa407147d1c69d2824d703

SHA1
2e3e8a3454262016d1d453c702a0dc8b42e29d5f

SHA256
bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6

SHA512
06dd4db7a2664f66c5c8340aae5ee4b7cd928e20a02bb1451db868ea36159d6a5f4901fa881631ca6d9bd0ec290fc36c04be90c3cc75cb164ea2a247549add64

Download Submit
\Users\Admin\AppData\Roaming\adobeflash.exe
Filesize
134KB

MD5
99a307128daa407147d1c69d2824d703

SHA1
2e3e8a3454262016d1d453c702a0dc8b42e29d5f

SHA256
bc7dd5d2fcb072941a2aa9752d0ec8e0933d0ee5406b0d117d9c455083e835d6

SHA512
06dd4db7a2664f66c5c8340aae5ee4b7cd928e20a02bb1451db868ea36159d6a5f4901fa881631ca6d9bd0ec290fc36c04be90c3cc75cb164ea2a247549add64

Download Submit
memory/1632-57-0x0000000000000000-mapping.dmp

Download
memory/1668-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1784-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads