145342b0dc0925cfd82bd41d2494530f8333f32bf415039696e9fe9219014f56

Analysis

max time kernel
65s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 23:44

Target

145342b0dc0925cfd82bd41d2494530f8333f32bf415039696e9fe9219014f56.exe
Size

408KB
MD5

dd496c421843160524b7c1b5084fd6d2
SHA1

7f567d15601e721ff03d29075257ec8f2925c23e
SHA256

145342b0dc0925cfd82bd41d2494530f8333f32bf415039696e9fe9219014f56
SHA512

a2e93a7b421bb68e713dcab95e4e0fd3c5c19ff8d2fdd26bab8e412e7b6e1a039bf0ac1b8caf71f77cb70b86b0063a89f9965f38bb9e245c1c09a203285277b8
SSDEEP

6144:RLDes+iJ6wiihAReY6RCyptFf/7iqkIvW23SiTvAr9M6MyIxZ1WqqdSv9x:RferChAYY6IyzFOD23CibA51MdYU

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	5100	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5100	145342b0dc0925cfd82bd41d2494530f8333f32bf415039696e9fe9219014f56.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	145342b0dc0925cfd82bd41d2494530f8333f32bf415039696e9fe9219014f56.exe

C:\Users\Admin\AppData\Local\Temp\145342b0dc0925cfd82bd41d2494530f8333f32bf415039696e9fe9219014f56.exe
"C:\Users\Admin\AppData\Local\Temp\145342b0dc0925cfd82bd41d2494530f8333f32bf415039696e9fe9219014f56.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 1268
  2⤵
  - Program crash
  PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5100 -ip 5100
1⤵
PID:1932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/5100-132-0x00000000006E8000-0x0000000000717000-memory.dmp

Filesize
188KB

Download
memory/5100-133-0x0000000000600000-0x000000000064B000-memory.dmp

Filesize
300KB

Download
memory/5100-134-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/5100-135-0x0000000004C90000-0x0000000005234000-memory.dmp

Filesize
5.6MB

Download
memory/5100-136-0x0000000005240000-0x0000000005858000-memory.dmp

Filesize
6.1MB

Download
memory/5100-137-0x0000000005860000-0x000000000596A000-memory.dmp

Filesize
1.0MB

Download
memory/5100-138-0x0000000005980000-0x0000000005992000-memory.dmp

Filesize
72KB

Download
memory/5100-139-0x00000000059A0000-0x00000000059DC000-memory.dmp

Filesize
240KB

Download
memory/5100-140-0x0000000005C90000-0x0000000005D22000-memory.dmp

Filesize
584KB

Download
memory/5100-141-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/5100-142-0x00000000006E8000-0x0000000000717000-memory.dmp

Filesize
188KB

Download
memory/5100-143-0x0000000006440000-0x0000000006602000-memory.dmp

Filesize
1.8MB

Download
memory/5100-144-0x0000000006610000-0x0000000006B3C000-memory.dmp

Filesize
5.2MB

Download
memory/5100-145-0x00000000006E8000-0x0000000000717000-memory.dmp

Filesize
188KB

Download
memory/5100-146-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download