5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617

General

Target

5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
Size

68KB
MD5

73469a200a7549c95a33040c575604cb
SHA1

b40ad74fba4718e47237108e60667188bd4437c9
SHA256

5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617
SHA512

890b6c7f75c2e6b4caa3c5f26874027fef33d5f48cabc168ef94a4dbc6632c0806beeb9eeb088abbbb73431f264ebc1da10d1d4159eebebcdf7c6c5d294e4e7f
SSDEEP

768:NwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:N47urp3v23HSa0AMNyfQ1d2y4Z4P

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4620 392 WerFault.exe winver.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winver.exe

pid process

392 winver.exe
392 winver.exe

pid	pid_target	process	target process
4620	392	WerFault.exe	winver.exe

pid	process
392	winver.exe
392	winver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

392 winver.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe

pid process

1472 5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe

pid	process
392	winver.exe

pid	process
1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exewinver.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Users\Admin\AppData\Local\Temp\5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
"C:\Users\Admin\AppData\Local\Temp\5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472

C:\Users\Admin\AppData\Local\Temp\5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
"C:\Users\Admin\AppData\Local\Temp\5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\SysWOW64\winver.exe
winver
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 636
5⤵
- Program crash
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 392 -ip 392
1⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3812,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
1⤵
PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-6-0x0000000000EF0000-0x0000000000EF7000-memory.dmp

Filesize
28KB

Download
memory/392-10-0x0000000000F80000-0x0000000000F92000-memory.dmp

Filesize
72KB

Download
memory/392-9-0x0000000000F81000-0x0000000000F82000-memory.dmp

Filesize
4KB

Download
memory/392-15-0x0000000000EF0000-0x0000000000EF7000-memory.dmp

Filesize
28KB

Download
memory/1472-2-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/2616-13-0x0000000000E00000-0x0000000000E07000-memory.dmp

Filesize
28KB

Download
memory/2616-14-0x0000000000E00000-0x0000000000E07000-memory.dmp

Filesize
28KB

Download
memory/3520-8-0x0000000002510000-0x0000000002517000-memory.dmp

Filesize
28KB

Download
memory/3520-5-0x0000000002510000-0x0000000002517000-memory.dmp

Filesize
28KB

Download
memory/3520-11-0x00007FFCC6C8D000-0x00007FFCC6C8E000-memory.dmp

Filesize
4KB

Download
memory/5044-4-0x0000000000400000-0x0000000000404A00-memory.dmp

Filesize
18KB

Download
memory/5044-3-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

description	pid	process	target process
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 1472 wrote to memory of 5044	1472	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 5044 wrote to memory of 392	5044	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 5044 wrote to memory of 392	5044	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 5044 wrote to memory of 392	5044	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 5044 wrote to memory of 392	5044	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 392 wrote to memory of 3520	392	winver.exe	Explorer.EXE
PID 392 wrote to memory of 2616	392	winver.exe	sihost.exe

Analysis

Sharing