Overview

overview

10

Static

static

6f48aaebb4...93.exe

windows7-x64

10

6f48aaebb4...93.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2022 02:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f48aaebb4a87f1736a4cc312a4373a4f2615f5cdf74fe25c83cbe9c5002f893.exe

  • Size

    632KB

  • MD5

    02a1b61b306162f9ff6b98d2d587758f

  • SHA1

    e69f6a2765fddded985d831b019d0f60893fae6f

  • SHA256

    6f48aaebb4a87f1736a4cc312a4373a4f2615f5cdf74fe25c83cbe9c5002f893

  • SHA512

    50f4e6c94d6eef5e0e64f438acdd7e737c79001bfc0f552b0d3911953d92dc0b975de2ae26b3778f42addc48eb9355b56eea03a5c4063024e52a084255a275c5

  • SSDEEP

    6144:5/na4LMTT71lbyD+SEykUKSSZNQkqp6wlfpIzQxpHH4Y5cm/9pBWF2fiiO7zM/iy:xnaSMTT71MKSErYwwgzSHYdTiO8/Ui

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables taskbar notifications via registry modification
    evasion
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Program crash 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f48aaebb4a87f1736a4cc312a4373a4f2615f5cdf74fe25c83cbe9c5002f893.exe
    "C:\Users\Admin\AppData\Local\Temp\6f48aaebb4a87f1736a4cc312a4373a4f2615f5cdf74fe25c83cbe9c5002f893.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • System policy modification
    PID:2200
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 540
      2⤵
      • Program crash
      PID:4940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 672
      2⤵
      • Program crash
      PID:2576
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 728
      2⤵
      • Program crash
      PID:2664
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 736
      2⤵
      • Program crash
      PID:1728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 740
      2⤵
      • Program crash
      PID:2044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 732
      2⤵
      • Program crash
      PID:4444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 700
      2⤵
      • Program crash
      PID:2040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 844
      2⤵
      • Program crash
      PID:740
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1020
      2⤵
      • Program crash
      PID:800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1020
      2⤵
      • Program crash
      PID:260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1376
      2⤵
      • Program crash
      PID:3316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 876
      2⤵
      • Program crash
      PID:4276
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 824
      2⤵
      • Program crash
      PID:1580
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2200 -ip 2200
    1⤵
      PID:5028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2200 -ip 2200
      1⤵
        PID:1820
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2200 -ip 2200
        1⤵
          PID:1696
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2200 -ip 2200
          1⤵
            PID:2332
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2200 -ip 2200
            1⤵
              PID:1308
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2200 -ip 2200
              1⤵
                PID:1248
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2200 -ip 2200
                1⤵
                  PID:3176
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2200 -ip 2200
                  1⤵
                    PID:480
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2200 -ip 2200
                    1⤵
                      PID:948
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2200 -ip 2200
                      1⤵
                        PID:112
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2200 -ip 2200
                        1⤵
                          PID:1096
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2200 -ip 2200
                          1⤵
                            PID:548
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2200 -ip 2200
                            1⤵
                              PID:4440

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • memory/2200-132-0x0000000000400000-0x00000000007A3000-memory.dmp

                              Filesize

                              3.6MB

                              Download

                            • memory/2200-133-0x0000000000C00000-0x0000000000C03000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/2200-134-0x0000000000400000-0x00000000007A3000-memory.dmp

                              Filesize

                              3.6MB

                              Download