ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90

General

Target

ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
Size

213KB
MD5

9f56c78b9409d1d1af7b9a7b996eca57
SHA1

664107f2d267ad84a5ab4a41bb142b2d460f081c
SHA256

ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90
SHA512

0d96b35c68a0af651f74fe8a24310f041b5a213f82fc4d86d431c25d7ecaf3d35813ba306e194fd2e4cb8da82e05bf3fa04e4cc909e43b3bec7621a91fac5824
SSDEEP

6144:ztvBPnU1b7e9SQii1EkoNlhlrQ2ZrM2xo:Zv1nWdQP1EDhZPxo

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2912	Isass.exe

Loads dropped DLL 5 IoCs

pid	Process
2852	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
2852	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Program Files (x86)\\Microsoft Build\\Isass.exe"	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Program Files (x86)\\Microsoft Build\\Isass.exe"	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Build\Isass.exe	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	2912	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2852	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
2912	Isass.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2912	2852	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe	28
PID 2852 wrote to memory of 2912	2852	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe	28
PID 2852 wrote to memory of 2912	2852	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe	28
PID 2852 wrote to memory of 2912	2852	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe	28
PID 2912 wrote to memory of 2716	2912	Isass.exe	31
PID 2912 wrote to memory of 2716	2912	Isass.exe	31
PID 2912 wrote to memory of 2716	2912	Isass.exe	31
PID 2912 wrote to memory of 2716	2912	Isass.exe	31

C:\Users\Admin\AppData\Local\Temp\ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
"C:\Users\Admin\AppData\Local\Temp\ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Microsoft Build\Isass.exe
  "C:\Program Files (x86)\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 352
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Build\Isass.exe

Filesize
213KB

MD5
9f56c78b9409d1d1af7b9a7b996eca57

SHA1
664107f2d267ad84a5ab4a41bb142b2d460f081c

SHA256
ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90

SHA512
0d96b35c68a0af651f74fe8a24310f041b5a213f82fc4d86d431c25d7ecaf3d35813ba306e194fd2e4cb8da82e05bf3fa04e4cc909e43b3bec7621a91fac5824

Download Submit
memory/2852-10-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2852-9-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2852-11-0x0000000003F60000-0x0000000005207000-memory.dmp

Filesize
18.7MB

Download
memory/2912-12-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2912-14-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-15-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-18-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-19-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-20-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-21-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-22-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-23-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-24-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-25-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/2912-30-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads