def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635

Analysis

max time kernel
177s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635.exe
Size

256KB
MD5

bd67760db10b7feda5d3547609fc8d2b
SHA1

1bd18eab65bae698096c69ba3ef50ce29586ca15
SHA256

def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635
SHA512

d2991f13244eeabdd80de9b02d0ff6a22d934c2fb3f9823e35664acde9a07708c7f474459bbb16c8767802f4b073323e301a0002a81513d319ea25ef26af1885
SSDEEP

3072:UDIV/QRJyJASzJtJulyjkmX6/OnD3aE+eia8xHJMKxsj/pnn0rTtwoQBTt:Us/LPztulItN3aE+ewxCxdRoQ3

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SfKg6wIPuS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635.exe"	def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	4120	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4120	def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635.exe

C:\Users\Admin\AppData\Local\Temp\def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635.exe
"C:\Users\Admin\AppData\Local\Temp\def33b13263ef3ed84f1c4e11ed054ea76ba5b50baed8e2a8a82adb181a74635.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 1068
  2⤵
  - Program crash
  PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4120 -ip 4120
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads