Analysis
- max time kernel
97s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
04/06/2023, 02:03
General
- Target file.exe
- Size 509KB
- Sample230604-cgpdwsag22
- SHA256 4d394ab71802f94b89ba5d62bdb2faebc5b500acbc2a362339ba451517710441
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 10083⤵
- Program crash
-
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4500 -ip 45001⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3924-155-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-157-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-162-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-161-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-138-0x0000017B2CF80000-0x0000017B2CF83000-memory.dmp
memory/3924-160-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-159-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-158-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-150-0x0000017B2D010000-0x0000017B2D017000-memory.dmp
memory/3924-152-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-153-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-151-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/3924-149-0x0000017B2CF80000-0x0000017B2CF83000-memory.dmp
memory/3924-154-0x00007FF44E8E0000-0x00007FF44EA0D000-memory.dmp
memory/4500-135-0x0000000004C10000-0x0000000004C17000-memory.dmp
memory/4500-134-0x0000000002EC0000-0x0000000002F30000-memory.dmp
memory/4500-148-0x0000000000400000-0x0000000002D26000-memory.dmp
memory/4500-145-0x0000000000400000-0x0000000002D26000-memory.dmp
memory/4500-146-0x0000000005B30000-0x0000000005B66000-memory.dmp
memory/4500-139-0x0000000005B30000-0x0000000005B66000-memory.dmp
memory/4500-137-0x0000000004E40000-0x0000000005240000-memory.dmp
memory/4500-136-0x0000000004E40000-0x0000000005240000-memory.dmp