Analysis Report Bank Swift.exe

ID:	326331
Product:	CloudBasic
Start time:	10:03:06
Start date:	03.12.2020
Sample:	Bank Swift.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	2ace5c4532c77c014a02cc027d725d83
SHA1:	c5d7fd7b905ec976af21fb78f7fbbb516767da2f
SHA256:	53ae2502a9fed69821959a54927023f131c6e62ebc46119d86e2eaad60356827
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Bank Swift.exe_80879c17d1924b75c27e84dfcffed9edc11fd3_314a8f1f_1523d379\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	EA65043C65221DFAA6535B5E5C8D4A46	5B7485476F7851722DC00FF87FF426F8E2D095AC	C823265D545749F44003CC1D426F0375DA2DB31B8B2EEAD56A16152FD71BBFA8
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4998.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Dec 3 18:04:04 2020, 0x1205a4 type	13F1799F03A7AC23B94D4A5BF4B5DA79	5411C2FD439B32289C5C5F098B3F4F7B9EB633F0	C2450E30D3F812B94D5D9EDF74CC8E9063305258925B33212ADF7A21680678B9
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AF0.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	1E3244F8DED4DEFD69A9D28898100BB1	55C50AE05E7F994FDC542F07616FFD6EF1C7C49A	F2B6ED1C8EEF0BEDFFA701EBCAACC0F33CBA5E8E95FBCB0D6881E4986868FBFA
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4CB7.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	B2F80A7136344658E844048CED2DB972	1D1B6AE6734B2C4E02769F85D76EC81261ED0485	617DD1B8B5152EC8682E17B28D583C07268A5C2E717C9051983F31D52095DF02

AV Detection:

Machine Learning detection for sample

Source: Bank Swift.exe

Joe Sandbox ML: detected

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: g.msn.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: Bank Swift.exe, 00000000.00000002.326572025.000000000074A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

PE file has a writeable .text section

Source: Bank Swift.exe

Static PE information: Section: .text IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

One or more processes crash

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 216

PE file contains strange resources

Source: Bank Swift.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

PE file does not import any functions

Source: Bank Swift.exe

Static PE information: No import functions for PE file found

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: phoneinfo.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: ext-ms-win-xblauth-console-l1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: ext-ms-win-xblauth-console-l1.dll			Jump to behavior

Classification label

Source: classification engine

Classification label: mal48.winEXE@2/4@2/0

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4696

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4998.tmp

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\Bank Swift.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Bank Swift.exe 'C:\Users\user\Desktop\Bank Swift.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 216

Binary contains paths to debug symbols

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000003.00000003.247353415.0000000000806000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000003.00000003.247395897.000000000080C000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000003.00000003.247395897.000000000080C000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000003.00000003.247388259.0000000000800000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000003.00000003.247353415.0000000000806000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000003.00000003.248441590.0000000004A11000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000003.00000003.248441590.0000000004A11000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000003.00000003.247388259.0000000000800000.00000004.00000001.sdmp

Hooking and other Techniques for Hiding and Protection:

Stores large binary data to the registry

Source: C:\Windows\SysWOW64\WerFault.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363} DeviceTicket

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\SysWOW64\WerFault.exe

File opened: PhysicalDrive0

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: WerFault.exe, 00000003.00000002.325471501.0000000004B00000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000003.00000003.255617815.0000000000813000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000003.00000002.325471501.0000000004B00000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000003.00000002.325471501.0000000004B00000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000003.00000003.323211758.00000000007DA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW)1
Source: WerFault.exe, 00000003.00000003.254391786.0000000000813000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: WerFault.exe, 00000003.00000002.325471501.0000000004B00000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Windows\SysWOW64\WerFault.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\Bank Swift.exe

Process queried: DebugPort

Jump to behavior

Enables debug privileges

Source: C:\Windows\SysWOW64\WerFault.exe

Process token adjusted: Debug

Jump to behavior