1af5805ca8f035123fa89eea0eba3945a9dce47c376ced924501569ae8e5cdc6

Analysis

max time kernel
153s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

196KB
MD5

610ac369f1ae1bd0f3b864a833436c9b
SHA1

4653947d9ed2c390063058e48cd9e8f19ea5f9e9
SHA256

1af5805ca8f035123fa89eea0eba3945a9dce47c376ced924501569ae8e5cdc6
SHA512

4cbfd9e2850c7a9f70608ea58a1ed37e776f63e3f86a96e768d85988a79dd228c6dadf96d4fd2946a5e7f10abe08d8a35a2f7e9794618b25263dcd3c2704b3c7
SSDEEP

3072:UWq9O/I7EkD7zxhL24jWMd5rwbCJb4ZqyborirgvTN82S:pq91Eq3TLRjjVJeqygTtS

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3928	4892	WerFault.exe	71

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	file.exe
4892	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1000
  2⤵
  - Program crash
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4892 -ip 4892
1⤵
PID:4008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4892-132-0x000000000066D000-0x0000000000680000-memory.dmp

Filesize
76KB

Download
memory/4892-133-0x0000000002360000-0x0000000002375000-memory.dmp

Filesize
84KB

Download
memory/4892-134-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4892-135-0x000000000066D000-0x0000000000680000-memory.dmp

Filesize
76KB

Download
memory/4892-136-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4892-137-0x000000000066D000-0x0000000000680000-memory.dmp

Filesize
76KB

Download
memory/4892-138-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download