bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae

Analysis

max time kernel
171s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae.exe
Size

427KB
MD5

3ef5813b5efb3411df67db6ccb32327d
SHA1

b36c24e6b100eba841a75c08e189b6df4b93a325
SHA256

bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae
SHA512

69cf938952a33bb3b18a9e6c13c3220029a32ec37062e6fba702abdabd0643e67f92bf7487c1cfd6a430b809035f37b597107615be678c62abba0ba1c3fbf3bb
SSDEEP

6144:tfcwuO3NYDsNAdnQWMAN6l5yjiqXRZtWpfvxs5kiha0Al3EsRy2LaQt:tfc7O3N50BMukyHgG51A5WQ

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1836	pMpOaDh06108.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4332-132-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4332-134-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4332-135-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1836-142-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4332-143-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1836-144-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4332-145-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pMpOaDh06108 = "C:\\ProgramData\\pMpOaDh06108\\pMpOaDh06108.exe"	pMpOaDh06108.exe

Program crash 25 IoCs

pid	pid_target	Process	procid_target
4952	4332	WerFault.exe	78
1104	1836	WerFault.exe	79
2488	1836	WerFault.exe	79
532	4332	WerFault.exe	78
208	1836	WerFault.exe	79
2040	4332	WerFault.exe	78
4196	1836	WerFault.exe	79
956	4332	WerFault.exe	78
4464	1836	WerFault.exe	79
4588	4332	WerFault.exe	78
4260	4332	WerFault.exe	78
2860	1836	WerFault.exe	79
4696	4332	WerFault.exe	78
1032	1836	WerFault.exe	79
2912	1836	WerFault.exe	79
3216	1836	WerFault.exe	79
1588	1836	WerFault.exe	79
2856	1836	WerFault.exe	79
3388	1836	WerFault.exe	79
1220	1836	WerFault.exe	79
3580	1836	WerFault.exe	79
4584	1836	WerFault.exe	79
3956	4332	WerFault.exe	78
1104	4332	WerFault.exe	78
2108	1836	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae.exe
Token: SeDebugPrivilege	1836	pMpOaDh06108.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1836	pMpOaDh06108.exe
1836	pMpOaDh06108.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1836	pMpOaDh06108.exe
1836	pMpOaDh06108.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1836	pMpOaDh06108.exe
1836	pMpOaDh06108.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1836	4332	bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae.exe	79
PID 4332 wrote to memory of 1836	4332	bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae.exe	79
PID 4332 wrote to memory of 1836	4332	bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae.exe	79

C:\Users\Admin\AppData\Local\Temp\bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae.exe
"C:\Users\Admin\AppData\Local\Temp\bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\ProgramData\pMpOaDh06108\pMpOaDh06108.exe
  "C:\ProgramData\pMpOaDh06108\pMpOaDh06108.exe" "C:\Users\Admin\AppData\Local\Temp\bd52b5e1c91df33445661eaa62ff429f204af844bba58d33586aa699f5e63eae.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 756
    3⤵
    - Program crash
    PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 764
    3⤵
    - Program crash
    PID:2488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 804
    3⤵
    - Program crash
    PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 784
    3⤵
    - Program crash
    PID:4196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 916
    3⤵
    - Program crash
    PID:4464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1004
    3⤵
    - Program crash
    PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1192
    3⤵
    - Program crash
    PID:1032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1292
    3⤵
    - Program crash
    PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1504
    3⤵
    - Program crash
    PID:3216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1512
    3⤵
    - Program crash
    PID:1588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1504
    3⤵
    - Program crash
    PID:2856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1580
    3⤵
    - Program crash
    PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1764
    3⤵
    - Program crash
    PID:1220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1772
    3⤵
    - Program crash
    PID:3580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1868
    3⤵
    - Program crash
    PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 932
    3⤵
    - Program crash
    PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 620
  2⤵
  - Program crash
  PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 636
  2⤵
  - Program crash
  PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 744
  2⤵
  - Program crash
  PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 752
  2⤵
  - Program crash
  PID:956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 852
  2⤵
  - Program crash
  PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 940
  2⤵
  - Program crash
  PID:4260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 1032
  2⤵
  - Program crash
  PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 488
  2⤵
  - Program crash
  PID:3956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 152
  2⤵
  - Program crash
  PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4332 -ip 4332
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1836 -ip 1836
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1836 -ip 1836
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4332 -ip 4332
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1836 -ip 1836
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4332 -ip 4332
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1836 -ip 1836
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4332 -ip 4332
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1836 -ip 1836
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4332 -ip 4332
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4332 -ip 4332
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1836 -ip 1836
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4332 -ip 4332
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1836 -ip 1836
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1836 -ip 1836
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1836 -ip 1836
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1836 -ip 1836
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1836 -ip 1836
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1836 -ip 1836
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1836 -ip 1836
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1836 -ip 1836
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1836 -ip 1836
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4332 -ip 4332
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4332 -ip 4332
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1836 -ip 1836
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\pMpOaDh06108\pMpOaDh06108.exe

Filesize
427KB

MD5
0d555178170b7861b08488a4a0130ffc

SHA1
e5fc45456d925f693facecc694dfcba229f53f02

SHA256
eb8ec6f39cbe178852ae0f3fc4067d4029caca261f38c79fd032c7a9d2cd80eb

SHA512
6d049fdf13dd0e53e1cde04c9f1649d374e4acbbf2b5427f51c515d9e03c48c5d8537a0b44944c030bda9da01b10dc924db894204655829930321146b8dea2aa

Download Submit
C:\ProgramData\pMpOaDh06108\pMpOaDh06108.exe

Filesize
427KB

MD5
0d555178170b7861b08488a4a0130ffc

SHA1
e5fc45456d925f693facecc694dfcba229f53f02

SHA256
eb8ec6f39cbe178852ae0f3fc4067d4029caca261f38c79fd032c7a9d2cd80eb

SHA512
6d049fdf13dd0e53e1cde04c9f1649d374e4acbbf2b5427f51c515d9e03c48c5d8537a0b44944c030bda9da01b10dc924db894204655829930321146b8dea2aa

Download Submit
memory/1836-142-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1836-144-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4332-132-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4332-134-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4332-135-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4332-143-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4332-145-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download