Analysis
-
max time kernel
201s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06-12-2022 20:14
General
-
Target
f14cd73974dc368f2502674200345c14e79be76a4773df0f493ff761a5a40ded.exe
-
Size
328KB
-
MD5
abb35fbac1f5adfa64c92b0647b80b8a
-
SHA1
3341e17dbe41532f82e45013b7316396e88bb5b8
-
SHA256
f14cd73974dc368f2502674200345c14e79be76a4773df0f493ff761a5a40ded
-
SHA512
df4e2af096857e5895482a4a7b70f42d4c803922d9cca4f57afcc6142e9fcf0b418fded84e03e7300b9c6840e39f0526f93ea60af8d445b3952217f76f9abb1b
-
SSDEEP
1536:eiqtNbrCzMWziPkO8zCQrcS0zS3paXusK/Oyu/cdt:m/us8zPb0zStPEUt
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f14cd73974dc368f2502674200345c14e79be76a4773df0f493ff761a5a40ded.exe"C:\Users\Admin\AppData\Local\Temp\f14cd73974dc368f2502674200345c14e79be76a4773df0f493ff761a5a40ded.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 3882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2820 -ip 28201⤵