Analysis
-
max time kernel
185s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 20:43
Static task
static1
Behavioral task
behavioral1
Sample
c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe
-
Size
532KB
-
MD5
5add16bad399367a797077a9b4e8f05e
-
SHA1
72c2a88f0888ffba938641b20034848aaee5f61d
-
SHA256
c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70
-
SHA512
2870f810777d5b25999b6b0ebe3cda2c13d0e6254d97350d21ab7c73526950cb6de1d74f994b6b779975abe55e2439c3e315798d891e47652c4370e66b7092d0
-
SSDEEP
12288:9E4Zlkz9u7YmKpRJmqzV/GwcLQo3wkZC/:9Eglkz9u7YFRwqp/GwaQkwp
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3568 3500 WerFault.exe 76 -
Modifies registry class 58 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\AuxUserType\2 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\AuxUserType\3\ = "Microsoft Excel Binary 12" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DocObject\ = "16" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocHandler32\ = "ole32.dll" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\LocalServer32 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Conversion\ReadWritable c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Conversion\ReadWritable\Main\ = "Biff12,ExcelML12,ExcelODS12,Biff8" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Insertable c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA} c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Conversion\Readable\Main c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Conversion\Readable\Main\ = "Biff12,ExcelWorksheet,ExcelML12,ExcelODS12,Biff8" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\MiscStatus\ = "0" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb\0\ = "&Edit,0,2" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ = "Microsoft Excel Binary Worksheet" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\AuxUserType\3 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\1 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DefaultExtension\ = ".xlsb, Excel Binary Workbook (*.xlsb)" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Implemented Categories\{000C0118-0000-0000-C000-000000000046} c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\2\ = "1,1,1,1" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DocObject c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocHandler32 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb\0 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb\1\ = "&Open,0,2" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Version c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\3 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DefaultIcon c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID\ = "Excel.SheetBinaryMacroEnabled.12" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\TypeLib c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\MiscStatus c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Implemented Categories c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\DefaultFile c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\4 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\TypeLib\ = "{00020813-0000-0000-C000-000000000046}" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\AuxUserType\2\ = "Binary Worksheet" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Conversion\Readable c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Implemented Categories\{000C0118-0000-0000-C000-000000000046}\ c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Version\ = "1.6" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\AuxUserType c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Conversion\ReadWritable\Main c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\1\ = "2,1,16,1" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Insertable\ c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\VersionIndependentProgID c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Conversion c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\DefaultFile\ = "BIFF12" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\4\ = "NoteshNote,-1,1,1" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DefaultExtension c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\LocalServer32\ = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\0 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\0\ = "3,1,32,1" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\3\ = "NotesDocInfo,1,1,1" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb\1 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DataFormats\GetSet\2 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\XLICONS.EXE,1" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\VersionIndependentProgID\ = "Excel.SheetBinaryMacroEnabled" c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3500 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe Token: SeIncBasePriorityPrivilege 3500 c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe"C:\Users\Admin\AppData\Local\Temp\c4ba87799a700ca2a6c9d76af47cce6b8dc2abb72322153a36caaae9a7dc7d70.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 10602⤵
- Program crash
PID:3568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3500 -ip 35001⤵PID:2888