fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d

General

Target

fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe
Size

4.6MB
MD5

61d18296fbf4499fe326766aa5ec6f55
SHA1

a56a4a9ff443d4c4f24a678177cf8732e2fc8388
SHA256

fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d
SHA512

616b8b856b3fd2a5ff4c896b07e87f76f3ea291bbe780e9eee29f12e8cd373f62d28e09239b0c622100f66b2bd20fe7f774b6f98bb461ebbfd64b3ed5bdfe2b1
SSDEEP

98304:V7nqqaYBYU48nw0uLQNcaXnNNj+d/pRsG1UzsZsOl4KS/eXu:jaQjDnUQNrnq/T51Uo2g4KS/eXu

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe
2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe
2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	2940	WerFault.exe	27

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe
2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2296	2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe	28
PID 2940 wrote to memory of 2296	2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe	28
PID 2940 wrote to memory of 2296	2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe	28
PID 2940 wrote to memory of 2296	2940	fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe	28

C:\Users\Admin\AppData\Local\Temp\fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe
"C:\Users\Admin\AppData\Local\Temp\fcf1aaff7ac366328deab17c30bfb368bee935ebc71a8553a3b9362c10ead39d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 320
  2⤵
  - Program crash
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/2940-1-0x0000000076B90000-0x0000000076BD7000-memory.dmp

Filesize
284KB

Download
memory/2940-503-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-504-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-508-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-512-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-514-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-522-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-520-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-518-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-516-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-510-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-506-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-524-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-526-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-528-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-536-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-544-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-552-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-564-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-562-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-560-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-558-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-556-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-554-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-550-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-548-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-546-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-542-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-540-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-538-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-534-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-532-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download
memory/2940-530-0x0000000002810000-0x0000000002921000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing