24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d

Analysis

max time kernel
171s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe
Size

57KB
MD5

2288112ddbb4c58c0c12a7282226645a
SHA1

9c85dc47b5738ea472495283109e5c8871ad041d
SHA256

24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d
SHA512

4fbd1fd22b3f59b59839e220eaec1d6bd07f8fa6b8528c69e007d1afec4f6094ddd6a7bd1a6cff54317829bdf2d333cdbc058ac73266a8d071d45df93ea28557
SSDEEP

1536:gfCCBgCXgHN1G6xsNM4zs3G/SNd3G2Ae:ED+CXSN1GaEMgs3G/SNd3G2Ae

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

Loads dropped DLL 1 IoCs

Processes:

24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

pid process

4952 24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

description ioc process

File created C:\Windows\keyls.dll 24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

524 4952 WerFault.exe 24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

description	ioc	process
File created	C:\Windows\keyls.dll	24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

pid	pid_target	process	target process
524	4952	WerFault.exe	24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

pid	process
4952	24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe
4952	24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

description pid process

Token: SeDebugPrivilege 4952 24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

description	pid	process
Token: SeDebugPrivilege	4952	24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe

C:\Users\Admin\AppData\Local\Temp\24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe
"C:\Users\Admin\AppData\Local\Temp\24d5f06eb344e99f32ca1fdbd712f9d6dcb4f3b88069273570f3807af1e2342d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 864
2⤵
- Program crash
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4952 -ip 4952
1⤵
PID:1280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\keyls.dll
Filesize
4KB

MD5
b9d46531032ae27f0ff2a4f942eb6a5f

SHA1
9438659266cf14e3dc73d8ec87622e528947df92

SHA256
4d12b7829ef1d3d29ddd318ea6311269c59e1aaa80d9d92af5064abbbe0b380a

SHA512
201813e46774bcc9735e6c8ee7434acc54981e244f9caa25e0a559826b1c62272eedb160b59bffebfe20d2a6c0b0c618e8e835cf2e1c6c779c152e526a44a1c2

Download Submit