Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

cambridge.shareholdersuite.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	4.064007115455676
Filename:	cambridge.shareholdersuite.exe
Filesize:	16980992
MD5:	36a2a6c6f6ba38708f501acce1176f1c
SHA1:	b5dbb9cef3950df5ad736367fc402f4a2cd8f741
SHA256:	d7e7a93d26422463c14fe026463ba369fd02e538df3fc379007135fe8a301b41
SHA512:	f2e5029d11e18eb748738feb87619b92063aaf01320eec0f895ebbeccb265b7bc4d63ad9c51b609a90e7a417c908ef8f7103800a06137ed0b8c1ee42f9cb70cc
SSDEEP:	98304:ceJ3hNLMJf65l50LD77w5Nv5rgvB2ANt01vMJqMJ:1xsLHM5NBrK2Bvr
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...wM.c..............0.................. ........@.. ....................................`................................

Signature Hits	Behavior Group	Mitre Attack
Uses 32bit PE files	Compliance, System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
One or more processes crash	System Summary
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion Security Software Discovery
Sample reads its own file content	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Uses an in-process (OLE) Automation server	System Summary
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Uses Microsoft Silverlight	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cambridge.shareh_b0b1b6854f979e9e27d3f079aaadcb4db67090f2_dd0f84fe_82132d7a-9be1-4710-9e0b-377f233cb68f\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cambridge.shareh_b0b1b6854f979e9e27d3f079aaadcb4db67090f2_dd0f84fe_82132d7a-9be1-4710-9e0b-377f233cb68f\Report.wer
Category:	dropped
Dump:	Report.wer.3.dr
ID:	dr_3
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.8917153966165613
Encrypted:	false
Size:	65536
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74FA.tmp.dmp

Mini DuMP crash report, 14 streams, Tue Feb 7 18:54:09 2023, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER74FA.tmp.dmp
Category:	dropped
Dump:	WER74FA.tmp.dmp.3.dr
ID:	dr_0
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Tue Feb 7 18:54:09 2023, 0x1205a4 type
Entropy:	3.531005970180092
Encrypted:	false
Size:	129193
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER76EF.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER76EF.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER76EF.tmp.WERInternalMetadata.xml.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.6990298569740547
Encrypted:	false
Size:	8402
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER775D.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER775D.tmp.xml
Category:	dropped
Dump:	WER775D.tmp.xml.3.dr
ID:	dr_2
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.517850488965283
Encrypted:	false
Size:	4767
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.3.dr
ID:	dr_4
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.264313122457509
Encrypted:	false
Size:	1048576
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve.LOG1
Category:	dropped
Dump:	Amcache.hve.LOG1.3.dr
ID:	dr_5
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	3.513830756732477
Encrypted:	false
Size:	28672
Whitelisted:	false
Reputation:	low

IPs

Domain

Country

Malicious

20.189.173.20

unknown

United States

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
cambridge.shareholdersuite.exe

Files

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportcambridge.shareholdersuite.exe

Files

IPs

IOC Report
cambridge.shareholdersuite.exe