b567e075b6b0984b5b05239063899580236cd8b10d70096f7df65a6214630f82

General

Target

46ce3d5f62b6267eee172b30d9c394f5.exe
Size

324KB
MD5

46ce3d5f62b6267eee172b30d9c394f5
SHA1

80bace305ca8f18c7a5d822c6c842548c6426289
SHA256

b567e075b6b0984b5b05239063899580236cd8b10d70096f7df65a6214630f82
SHA512

d4b31b0b6e238fab5a466caadd4f28fd9d68e101caa839b768a33d603f841d9d79bcf762a8ec482e26cafe3db5fb5ac019d96605fb5d5ab88fdaa812372d1fa4
SSDEEP

6144:wDQLwWqBAQW34tsSfETSHVFsX69K3tDA2L:Np4tsNSjC73tDA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	1420	WerFault.exe	1

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\Software\CLASSES\CID\{2B005700-4200-4E00-3000-560044007900}	46ce3d5f62b6267eee172b30d9c394f5.exe
Key created	\REGISTRY\USER\Software	46ce3d5f62b6267eee172b30d9c394f5.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\CLASSES\CID	46ce3d5f62b6267eee172b30d9c394f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\CLASSES\CID\{2B005700-4200-4E00-3000-560044007900}\1 = "zQXxUUDYjnVOd/FAjKfpJYPove1Pzagb7Y6JMmQBia910X1gpzFi8pjcrKsXq4dsy48sVBzaWvHFn/xIZUgD6QmUdu0gAiXalYAgWYJ9zF4dZT0yTWX+Rs72QBcBYwq8ZOBk4SeF9QOgUVp6seRqOEYgVgE80lo9QRqiJuKaLCPSTqVg3CPOv8+6ecD9RjvO+XPsFj0YIViRryfjri/D/zexjhQgNl7AC2B47cuxGo3xK0eHgKMP9QeMp3fUrwtO3+r2biEfxlqd8floySrAc6gu7UwG1xCjztk+lZuR3ojnlJWkQqKPz1/2P5b9cKqo19Q1MssgQro9tIgo1/7H6aTRJpvk4kLGDumQFWtXmlX8eDYhz2MzVnl/1a9Zpr8aYqgyPH2hXjbR0SzQo/j9+XqmWvwzxn6Y+8tw6jTN84WxQIeEScdjjsWFL3XJtOFQtcVPXGlY0/ivRY8BZePRUhGogQEGZh3UMzpn7pa/SrVaXkOJY7p3FduSXDLWp58y"	46ce3d5f62b6267eee172b30d9c394f5.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CID\{2B005700-4200-4E00-3000-560044007900}	46ce3d5f62b6267eee172b30d9c394f5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\CLASSES\CID\{2B005700-4200-4E00-3000-560044007900}	46ce3d5f62b6267eee172b30d9c394f5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	46ce3d5f62b6267eee172b30d9c394f5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\CLASSES\CID\{2B005700-4200-4E00-3000-560044007900}	46ce3d5f62b6267eee172b30d9c394f5.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\CID\{2B005700-4200-4E00-3000-560044007900}	46ce3d5f62b6267eee172b30d9c394f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CID\{2B005700-4200-4E00-3000-560044007900}\1 = "zQXxUUDYjnVOd/FAjKfpJYPove1Pzagb7Y6JMmQBia910X1gpzFi8pjcrKsXq4dsy48sVBzaWvHFn/xIZUgD6QmUdu0gAiXalYAgWYJ9zF4dZT0yTWX+Rs72QBcBYwq8ZOBk4SeF9QOgUVp6seRqOEYgVgE80lo9QRqiJuKaLCPSTqVg3CPOv8+6ecD9RjvO+XPsFj0YIViRryfjri/D/zexjhQgNl7AC2B47cuxGo3xK0eHgKMP9QeMp3fUrwtO3+r2biEfxlqd8floySrAc6gu7UwG1xCjztk+lZuR3ojnlJWkQqKPz1/2P5b9cKqo19Q1MssgQro9tIgo1/7H6aTRJpvk4kLGDumQFWtXmlX8eDYhz2MzVnl/1a9Zpr8aYqgyPH2hXjbR0SzQo/j9+XqmWvwzxn6Y+8tw6jTN84WxQIeEScdjjsWFL3XJtOFQtcVPXGlY0/ivRY8BZePRUhGogQEGZh3UMzpn7pa/SrVaXkOJY7p3FduSXDLWp58y"	46ce3d5f62b6267eee172b30d9c394f5.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CID	46ce3d5f62b6267eee172b30d9c394f5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CID\{2B005700-4200-4E00-3000-560044007900}\1 = "zQXxUUDYjnVOd/FAjKfpJYPove1Pzagb7Y6JMmQBia910X1gpzFi8pjcrKsXq4dsy48sVBzaWvHFn/xIZUgD6QmUdu0gAiXalYAgWYJ9zF4dZT0yTWX+Rs72QBcBYwq8ZOBk4SeF9QOgUVp6seRqOEYgVgE80lo9QRqiJuKaLCPSTqVg3CPOv8+6ecD9RjvO+XPsFj0YIViRryfjri/D/zexjhQgNl7AC2B47cuxGo3xK0eHgKMP9QeMp3fUrwtO3+r2biEfxlqd8floySrAc6gu7UwG1xCjztk+lZuR3ojnlJWkQqKPz1/2P5b9cKqo19Q1MssgQro9tIgo1/7H6aTRJpvk4kLGDumQFWtXmlX8eDYhz2MzVnl/1a9Zpr8aYqgyPH2hXjbR0SzQo/j9+XqmWvwzxn6Y+8tw6jTN84WxQIeEScdjjsWFL3XJtOFQtcVPXGlY0/ivRY8BZePRUhGogQEGZh3UMzpn7pa/SrVaXkOJY7p3FduSXDLWp58y"	46ce3d5f62b6267eee172b30d9c394f5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\CLASSES	46ce3d5f62b6267eee172b30d9c394f5.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\MSOCache:{2B005700-4200-4E00-3000-560044007900}	46ce3d5f62b6267eee172b30d9c394f5.exe
File created	C:\Users\Admin\AppData\Local\Temp:{2B005700-4200-4E00-3000-560044007900}	46ce3d5f62b6267eee172b30d9c394f5.exe
File created	C:\Users\Admin\Documents\My Music:{2B005700-4200-4E00-3000-560044007900}	46ce3d5f62b6267eee172b30d9c394f5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2724	1420	46ce3d5f62b6267eee172b30d9c394f5.exe	29
PID 1420 wrote to memory of 2724	1420	46ce3d5f62b6267eee172b30d9c394f5.exe	29
PID 1420 wrote to memory of 2724	1420	46ce3d5f62b6267eee172b30d9c394f5.exe	29
PID 1420 wrote to memory of 2724	1420	46ce3d5f62b6267eee172b30d9c394f5.exe	29

C:\Users\Admin\AppData\Local\Temp\46ce3d5f62b6267eee172b30d9c394f5.exe
"C:\Users\Admin\AppData\Local\Temp\46ce3d5f62b6267eee172b30d9c394f5.exe"
1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1160
  2⤵
  - Program crash
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-0-0x0000000000EB0000-0x0000000000F08000-memory.dmp

Filesize
352KB

Download
memory/1420-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/1420-3-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/1420-5-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/1420-6-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads