Analysis
-
max time kernel
56s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 20:14
Behavioral task
behavioral1
Sample
b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe
Resource
win10v2004-20230220-en
General
-
Target
b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe
-
Size
1.1MB
-
MD5
68b4a29de16ff7dac179bdb49c2c75eb
-
SHA1
d7f6e0cce19e934fd6b429a3d912c7dc62731921
-
SHA256
b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163
-
SHA512
a7f1e59db40eecaad44b22fedc4f6b722f0b1caa7e8775d74cfda4974f01b82a8c9dba3cf8b046b5b5daeaa4edde0c18a943744c9974fc75f47b34d7fce18e3a
-
SSDEEP
24576:/LckjuxpotAiy0SBrS3IuqZdoaiG9cMZ2rYWtBay2Ka:/LckcCLNS9S3Iuq3baMk0Ua
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1296 4608 WerFault.exe b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe -
Modifies Control Panel 3 IoCs
Processes:
b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\sShortDate = "yyyy-MM-dd" b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\iDate = "2" b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\sDate = "-" b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe"C:\Users\Admin\AppData\Local\Temp\b1646b4adfc7d4c2d50c3a1291cf032d88d3516a3ae9a35dc9790d46de84d163.exe"1⤵
- Modifies Control Panel
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 12682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4608 -ip 46081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4608-133-0x0000000000400000-0x0000000000773000-memory.dmpFilesize
3.4MB
-
memory/4608-135-0x0000000000400000-0x0000000000773000-memory.dmpFilesize
3.4MB
-
memory/4608-136-0x0000000000400000-0x0000000000773000-memory.dmpFilesize
3.4MB
-
memory/4608-137-0x00000000026F0000-0x00000000026F1000-memory.dmpFilesize
4KB
-
memory/4608-138-0x0000000000400000-0x0000000000773000-memory.dmpFilesize
3.4MB
-
memory/4608-140-0x0000000000400000-0x0000000000773000-memory.dmpFilesize
3.4MB
-
memory/4608-142-0x0000000000400000-0x0000000000773000-memory.dmpFilesize
3.4MB