Analysis
- max time kernel
135s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
15/06/2023, 00:00
General
- Target file.exe
- Size 417KB
- Sample230615-aaa7kseb37
- SHA256 37e0b7e14eaeeb2205c87261982e272eaa6dd4b95fdd2edc7b2a5b9d29b64a09
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 6923⤵
- Program crash
-
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5040 -ip 50401⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3364-151-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-157-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-162-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-161-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-138-0x000001BF700A0000-0x000001BF700A3000-memory.dmp
memory/3364-160-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-159-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-158-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-150-0x000001BF70130000-0x000001BF70137000-memory.dmp
memory/3364-154-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-155-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-152-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/3364-149-0x000001BF700A0000-0x000001BF700A3000-memory.dmp
memory/3364-153-0x00007FF459C80000-0x00007FF459DAD000-memory.dmp
memory/5040-135-0x0000000000670000-0x0000000000677000-memory.dmp
memory/5040-134-0x0000000002120000-0x0000000002191000-memory.dmp
memory/5040-148-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/5040-146-0x00000000031C0000-0x00000000031F6000-memory.dmp
memory/5040-140-0x00000000031C0000-0x00000000031F6000-memory.dmp
memory/5040-139-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/5040-137-0x0000000002480000-0x0000000002880000-memory.dmp
memory/5040-136-0x0000000002480000-0x0000000002880000-memory.dmp