19ea7bac511355b3b690cd3036a585746194bd2b1e015a1ee169f17dce1fac98

Analysis

max time kernel
0s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 16:39

Target

2dd1f8250c4e0d9f2ddec638c1d1de67.exe
Size

151KB
MD5

2dd1f8250c4e0d9f2ddec638c1d1de67
SHA1

49bad3744e9a29c4fa3c42aff42a5eb1078f1233
SHA256

19ea7bac511355b3b690cd3036a585746194bd2b1e015a1ee169f17dce1fac98
SHA512

c637c0e46834ac5cdec5a8e93a081b221dcfa0ee210d9b6aadf59be33995a25a088da3624294fc79086a53eef4699d8691f06d7c6f71e445b9fd6d9fdde914fa
SSDEEP

3072:O0cSaH64CXQ253QU6q8TXkKu1eWmmcfyo0:O07Qq15gU6dkFgWmm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3996	1888	WerFault.exe	12
3332	1888	WerFault.exe	12

Runs .reg file with regedit 1 IoCs

pid	Process
2356	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	2dd1f8250c4e0d9f2ddec638c1d1de67.exe
1888	2dd1f8250c4e0d9f2ddec638c1d1de67.exe

C:\Users\Admin\AppData\Local\Temp\2dd1f8250c4e0d9f2ddec638c1d1de67.exe
"C:\Users\Admin\AppData\Local\Temp\2dd1f8250c4e0d9f2ddec638c1d1de67.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888
- C:\Windows\SysWOW64\regedt32.exe
  "C:\Windows\System32\regedt32.exe" /s "C:\Users\Admin\Documents\Iterra\T03emp03.reg"
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\regedit.exe" /s "C:\Users\Admin\Documents\Iterra\T03emp03.reg"
    3⤵
    - Runs .reg file with regedit
    PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1012
  2⤵
  - Program crash
  PID:3996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1104
  2⤵
  - Program crash
  PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1888 -ip 1888
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1888 -ip 1888
1⤵
PID:916

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1888-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1888-3-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1888-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1888-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1888-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1888-12-0x00000000031B0000-0x0000000003283000-memory.dmp

Filesize
844KB

Download
memory/1888-11-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/1888-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1888-16-0x00000000031B0000-0x0000000003283000-memory.dmp

Filesize
844KB

Download
memory/1888-22-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download