7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d

Analysis

max time kernel
164s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Size

1.5MB
MD5

ce7e7e3b299776c3b5c2bbfa4c67860d
SHA1

74f5c4ea0ec167e4275e1de4c2c60f9a10393f69
SHA256

7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d
SHA512

617447ae1ec3a2e2d38656476f4c72ab7b3d129f11414e1c25d5686bda4166ad18989e4789e57bf4bf610c9f2fa8c68dc914aba81647708afdb91b9d631b8220
SSDEEP

24576:++6rhqNuKrW1QwBBfm/6bQRhJF5it4qd8w5WZe0eoBhpJQKt228IrtigO5qX:+7rh4rrdqGrot9d8w5WZ26Tnto3q

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4564 420 WerFault.exe 7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe

pid	pid_target	process	target process
4564	420	WerFault.exe	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe

Modifies registry class 10 IoCs

Processes:

7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe"	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.MyNSHandler"	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.MyNSHandler	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.MyNSHandler\ = "this is my ebook"	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.MyNSHandler\Clsid	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe

C:\Users\Admin\AppData\Local\Temp\7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe
"C:\Users\Admin\AppData\Local\Temp\7c9549d0d6b034e007bd7155faf9c8ddc223577e062a3dc0e4657f762dfba40d.exe"
1⤵
- Modifies registry class
PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 712
2⤵
- Program crash
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 420 -ip 420
1⤵
PID:3140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/420-132-0x0000000000400000-0x0000000000602000-memory.dmp

Filesize
2.0MB

Download
memory/420-133-0x0000000000400000-0x0000000000602000-memory.dmp

Filesize
2.0MB

Download