09812581a80831dbceb22a2f4433bb88cdcbc7af488baa19d5aaaef36a44ad7a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

er.exe
Size

5KB
MD5

775c383342fce22c3babbdf7133ecb11
SHA1

90e9cd7c0fe2375d3702a22909835e713036218b
SHA256

09812581a80831dbceb22a2f4433bb88cdcbc7af488baa19d5aaaef36a44ad7a
SHA512

44770bd1b439f9b158056599e3f86401414070758a10a538fdfecb02093d5038f2f0b4fa783cbebd752959b44900dd3841c58f689b1a5e1d963241a9f9677163
SSDEEP

48:6QaXcBlyhGio5OAI/6NMsbrSWiY/b/nJg/itUXl9fYRDFYvpfbNtm:GthG6A6Y/DWHYIBzNt

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2676	rundll32.exe
5	2676	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	2516	WerFault.exe	17

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\ServiceLocation	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\OOBGameInstalled = "1"	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2676	2516	er.exe	29
PID 2516 wrote to memory of 2676	2516	er.exe	29
PID 2516 wrote to memory of 2676	2516	er.exe	29
PID 2516 wrote to memory of 2676	2516	er.exe	29
PID 2516 wrote to memory of 2676	2516	er.exe	29
PID 2516 wrote to memory of 2676	2516	er.exe	29
PID 2516 wrote to memory of 2676	2516	er.exe	29
PID 2516 wrote to memory of 2780	2516	er.exe	30
PID 2516 wrote to memory of 2780	2516	er.exe	30
PID 2516 wrote to memory of 2780	2516	er.exe	30
PID 2516 wrote to memory of 2780	2516	er.exe	30

C:\Users\Admin\AppData\Local\Temp\er.exe
"C:\Users\Admin\AppData\Local\Temp\er.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {5edb1ddd-6a21-414f-bc6e-e6e5379b875c};C:\Users\Admin\AppData\Local\Temp\er.exe;2516
  2⤵
  - Blocklisted process makes network request
  - Modifies registry class
  PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 776
  2⤵
  - Program crash
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2516-3-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-2-0x0000000001030000-0x0000000001038000-memory.dmp

Filesize
32KB

Download
memory/2516-4-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download