Analysis
-
max time kernel
99s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe
Resource
win10v2004-20220812-en
General
-
Target
bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe
-
Size
98KB
-
MD5
878f216f41c7c5d7ed5d6785a1fa6be9
-
SHA1
5f2b9a1e1c309e628ed3404ccfe0189a4b131762
-
SHA256
bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88
-
SHA512
fcc24a63fb4dfc16995036898c3d9798b3d82702bc8a1334b1391fe958a2536adf5a67cd65617c176ba19e1f578feaca7b53fad90ce65f703ce8aa3d4597c648
-
SSDEEP
3072:wbby87RL8RTb/0vdCfvPeTXf3qDqGgn3VH5tQ9:8287RLj1pTXJxb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
service.exepid process 1668 service.exe -
Loads dropped DLL 5 IoCs
Processes:
bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exeWerFault.exepid process 952 bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe 952 bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\perflog\\service.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\perflog\\service.exe" reg.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1560 1668 WerFault.exe service.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exeservice.execmd.execmd.exedescription pid process target process PID 952 wrote to memory of 1668 952 bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe service.exe PID 952 wrote to memory of 1668 952 bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe service.exe PID 952 wrote to memory of 1668 952 bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe service.exe PID 952 wrote to memory of 1668 952 bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe service.exe PID 1668 wrote to memory of 1584 1668 service.exe cmd.exe PID 1668 wrote to memory of 1584 1668 service.exe cmd.exe PID 1668 wrote to memory of 1584 1668 service.exe cmd.exe PID 1668 wrote to memory of 1584 1668 service.exe cmd.exe PID 1584 wrote to memory of 1552 1584 cmd.exe reg.exe PID 1584 wrote to memory of 1552 1584 cmd.exe reg.exe PID 1584 wrote to memory of 1552 1584 cmd.exe reg.exe PID 1584 wrote to memory of 1552 1584 cmd.exe reg.exe PID 1668 wrote to memory of 1296 1668 service.exe cmd.exe PID 1668 wrote to memory of 1296 1668 service.exe cmd.exe PID 1668 wrote to memory of 1296 1668 service.exe cmd.exe PID 1668 wrote to memory of 1296 1668 service.exe cmd.exe PID 1296 wrote to memory of 1632 1296 cmd.exe reg.exe PID 1296 wrote to memory of 1632 1296 cmd.exe reg.exe PID 1296 wrote to memory of 1632 1296 cmd.exe reg.exe PID 1296 wrote to memory of 1632 1296 cmd.exe reg.exe PID 1668 wrote to memory of 1560 1668 service.exe WerFault.exe PID 1668 wrote to memory of 1560 1668 service.exe WerFault.exe PID 1668 wrote to memory of 1560 1668 service.exe WerFault.exe PID 1668 wrote to memory of 1560 1668 service.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe"C:\Users\Admin\AppData\Local\Temp\bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\perflog\service.exeC:\Users\Admin\AppData\Local\Temp\perflog\service.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.execmd /c "REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\perflog\service.exe /f"3⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\perflog\service.exe /f4⤵
- Adds Run key to start application
- Modifies registry key
PID:1552 -
C:\Windows\SysWOW64\cmd.execmd /c "REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\perflog\service.exe /f"3⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\perflog\service.exe /f4⤵
- Adds Run key to start application
- Modifies registry key
PID:1632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 5643⤵
- Loads dropped DLL
- Program crash
PID:1560
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\perflog\service.exeFilesize
98KB
MD5878f216f41c7c5d7ed5d6785a1fa6be9
SHA15f2b9a1e1c309e628ed3404ccfe0189a4b131762
SHA256bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88
SHA512fcc24a63fb4dfc16995036898c3d9798b3d82702bc8a1334b1391fe958a2536adf5a67cd65617c176ba19e1f578feaca7b53fad90ce65f703ce8aa3d4597c648
-
\Users\Admin\AppData\Local\Temp\perflog\service.exeFilesize
98KB
MD5878f216f41c7c5d7ed5d6785a1fa6be9
SHA15f2b9a1e1c309e628ed3404ccfe0189a4b131762
SHA256bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88
SHA512fcc24a63fb4dfc16995036898c3d9798b3d82702bc8a1334b1391fe958a2536adf5a67cd65617c176ba19e1f578feaca7b53fad90ce65f703ce8aa3d4597c648
-
\Users\Admin\AppData\Local\Temp\perflog\service.exeFilesize
98KB
MD5878f216f41c7c5d7ed5d6785a1fa6be9
SHA15f2b9a1e1c309e628ed3404ccfe0189a4b131762
SHA256bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88
SHA512fcc24a63fb4dfc16995036898c3d9798b3d82702bc8a1334b1391fe958a2536adf5a67cd65617c176ba19e1f578feaca7b53fad90ce65f703ce8aa3d4597c648
-
\Users\Admin\AppData\Local\Temp\perflog\service.exeFilesize
98KB
MD5878f216f41c7c5d7ed5d6785a1fa6be9
SHA15f2b9a1e1c309e628ed3404ccfe0189a4b131762
SHA256bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88
SHA512fcc24a63fb4dfc16995036898c3d9798b3d82702bc8a1334b1391fe958a2536adf5a67cd65617c176ba19e1f578feaca7b53fad90ce65f703ce8aa3d4597c648
-
\Users\Admin\AppData\Local\Temp\perflog\service.exeFilesize
98KB
MD5878f216f41c7c5d7ed5d6785a1fa6be9
SHA15f2b9a1e1c309e628ed3404ccfe0189a4b131762
SHA256bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88
SHA512fcc24a63fb4dfc16995036898c3d9798b3d82702bc8a1334b1391fe958a2536adf5a67cd65617c176ba19e1f578feaca7b53fad90ce65f703ce8aa3d4597c648
-
\Users\Admin\AppData\Local\Temp\perflog\service.exeFilesize
98KB
MD5878f216f41c7c5d7ed5d6785a1fa6be9
SHA15f2b9a1e1c309e628ed3404ccfe0189a4b131762
SHA256bd7180051e4b2f523be9e231fe90e6360629e882c8b473456ab41439cf666a88
SHA512fcc24a63fb4dfc16995036898c3d9798b3d82702bc8a1334b1391fe958a2536adf5a67cd65617c176ba19e1f578feaca7b53fad90ce65f703ce8aa3d4597c648
-
memory/1296-61-0x0000000000000000-mapping.dmp
-
memory/1552-59-0x0000000000000000-mapping.dmp
-
memory/1560-63-0x0000000000000000-mapping.dmp
-
memory/1584-58-0x0000000000000000-mapping.dmp
-
memory/1632-62-0x0000000000000000-mapping.dmp
-
memory/1668-60-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/1668-56-0x0000000000000000-mapping.dmp