Overview

overview

10

Static

static

bfe75fdc9f...ab.exe

windows7-x64

10

bfe75fdc9f...ab.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    165s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 05:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bfe75fdc9fe6b5de80cc18bd11f943b4d18172e37ddb6fc7170c8e9f126e2aab.exe

  • Size

    631KB

  • MD5

    374a423ba5c64c7ac87a3bcf45ed672a

  • SHA1

    fc0b1b41db5e5e2cf6e42a7e391d6054dbc219a1

  • SHA256

    bfe75fdc9fe6b5de80cc18bd11f943b4d18172e37ddb6fc7170c8e9f126e2aab

  • SHA512

    d9a96ef54a59f0e2f97240e923c914a2bc7a1f5f80242a8be6efd3b6769e11fcd06380fb66d487925c48277127d9bc95669101a690045de0183f43e38ac0c697

  • SSDEEP

    12288:d/G4YqH5E4FFaWbrxTYWWcxBGKzqfy32mYL/4:d+4YW5Ey7rpmaA0qfP

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables taskbar notifications via registry modification
    evasion
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Program crash 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfe75fdc9fe6b5de80cc18bd11f943b4d18172e37ddb6fc7170c8e9f126e2aab.exe
    "C:\Users\Admin\AppData\Local\Temp\bfe75fdc9fe6b5de80cc18bd11f943b4d18172e37ddb6fc7170c8e9f126e2aab.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • System policy modification
    PID:4988
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 536
      2⤵
      • Program crash
      PID:4844
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 548
      2⤵
      • Program crash
      PID:1416
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 680
      2⤵
      • Program crash
      PID:3576
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 548
      2⤵
      • Program crash
      PID:3484
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 768
      2⤵
      • Program crash
      PID:1772
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 776
      2⤵
      • Program crash
      PID:852
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 548
      2⤵
      • Program crash
      PID:3928
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 548
      2⤵
      • Program crash
      PID:904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 852
      2⤵
      • Program crash
      PID:4808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1096
      2⤵
      • Program crash
      PID:1424
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1116
      2⤵
      • Program crash
      PID:3188
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4988 -ip 4988
    1⤵
      PID:4880
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4988 -ip 4988
      1⤵
        PID:1488
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4988 -ip 4988
        1⤵
          PID:116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4988 -ip 4988
          1⤵
            PID:2312
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4988 -ip 4988
            1⤵
              PID:3420
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4988 -ip 4988
              1⤵
                PID:4904
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4988 -ip 4988
                1⤵
                  PID:3176
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4988 -ip 4988
                  1⤵
                    PID:1748
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4988 -ip 4988
                    1⤵
                      PID:2912
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4988 -ip 4988
                      1⤵
                        PID:4176
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4988 -ip 4988
                        1⤵
                          PID:444
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4988 -ip 4988
                          1⤵
                            PID:2692

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/4988-132-0x0000000000400000-0x00000000006A5000-memory.dmp

                            Filesize

                            2.6MB

                            Download

                          • memory/4988-133-0x00000000007F0000-0x00000000007F3000-memory.dmp

                            Filesize

                            12KB

                            Download

                          • memory/4988-134-0x0000000000400000-0x00000000006A5000-memory.dmp

                            Filesize

                            2.6MB

                            Download