Analysis
-
max time kernel
203s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 04:27
Static task
static1
Behavioral task
behavioral1
Sample
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe
Resource
win10v2004-20221111-en
General
-
Target
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe
-
Size
479KB
-
MD5
f96c5ab24260ea3e65e0154fc04c0a6a
-
SHA1
b4b8ad8fdca5ad5f6ac9a63d47656d6f290b49fb
-
SHA256
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73
-
SHA512
26c0b2b6e5600cbeec41fd4b659d25afe148b876dfd2ba8369b345f7ad81c755fc7ffe392205dbd673a2ce2ad5efa125e0a32d75f201c04cdbc13fab3fc02f1d
-
SSDEEP
12288:Sc//////idXwxOKGX67rLnn6T6i0Ckb8HeRKaslx457:Sc//////i6JGX67rL6ObCalRKa6m57
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1972-136-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-138-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-139-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-140-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-141-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-143-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-145-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-147-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-149-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-151-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-153-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-155-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-157-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-159-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-161-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-166-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-163-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-168-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-170-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-172-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-174-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-176-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-178-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-180-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-182-0x0000000002350000-0x000000000238D000-memory.dmp upx behavioral2/memory/1972-184-0x0000000002350000-0x000000000238D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exedescription pid process target process PID 4052 set thread context of 1972 4052 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4032 1972 WerFault.exe f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 4276 1972 WerFault.exe f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe -
Processes:
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879" f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879" f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
Processes:
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?28879" f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exepid process 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exepid process 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe 1972 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exedescription pid process target process PID 4052 wrote to memory of 1972 4052 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe PID 4052 wrote to memory of 1972 4052 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe PID 4052 wrote to memory of 1972 4052 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe PID 4052 wrote to memory of 1972 4052 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe PID 4052 wrote to memory of 1972 4052 f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe"C:\Users\Admin\AppData\Local\Temp\f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exeC:\Users\Admin\AppData\Local\Temp\f9bfea4949144d94d582f90d05a64200b35f08ef5f9090dc2151159948c71c73.exe2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 8843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1972 -ip 19721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1972 -ip 19721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-132-0x0000000000000000-mapping.dmp
-
memory/1972-133-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/1972-135-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/1972-136-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-138-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-139-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-140-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-141-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-143-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-145-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-147-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-149-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-151-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-153-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-155-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-157-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-159-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-161-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-164-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/1972-166-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-163-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-168-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-170-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-172-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-174-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-176-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-178-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-180-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-182-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB
-
memory/1972-183-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/1972-184-0x0000000002350000-0x000000000238D000-memory.dmpFilesize
244KB