460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820

Analysis

max time kernel
107s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2023 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Size

300KB
MD5

f298cdef9475c31e2095210d85e29414
SHA1

b1a707619eeb33941baa3cf610b83bec1fe12bdb
SHA256

460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820
SHA512

3c4dbe3b5074e4df4c1729c13a0ef144f9de007f835a17c722532dc573862ad4fa5c4fd0be9c606b27082d9278196c9ff26b72118b83698154bf7c503250c3be
SSDEEP

6144:N/QuX5B+qRyY99qyFpvcIvLyr+WlFFPOsxa9RISEBi:muXz+6yYrqyTh+jOsxgRISEE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4444 4600 WerFault.exe 460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

pid	pid_target	process	target process
4444	4600	WerFault.exe	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

Modifies registry class 10 IoCs

Processes:

460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler\Clsid	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler\ = "this is my ebook"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

C:\Users\Admin\AppData\Local\Temp\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
"C:\Users\Admin\AppData\Local\Temp\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe"
1⤵
- Modifies registry class
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 716
2⤵
- Program crash
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4600 -ip 4600
1⤵
PID:4176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4600-133-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4600-134-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4600-135-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download