Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

fxc.exe

PE32+ executable (GUI) x86-64, for MS Windows

initial sample

Details

Filetype:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	6.299817634972105
Filename:	fxc.exe
Filesize:	324608
MD5:	0b1904602a90ed190066095f29a3f92a
SHA1:	f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31
SHA256:	6e349195bdc65a1964367317ba14b905440d75398c3fbb1911c3400082d7f149
SHA512:	d18058b6b1a045d8544db79940ca5500843a71d3541c012b01d0a70648d0b210113b1715b608c3866d61f41db521109b7084a109a279dc306aed4544ffd17b54
SSDEEP:	6144:6BrFsAPhVdTPrOi4OU4Ym0D+slljJbJ3pvTVFIh:6BrFBEF3mEBvr
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E..0...c...c...cJ..b...cJ..b...cJ..b...c...b(..c...b...c...b...c...c...c...c...c9k.b...cRich...c................PE..d......f...

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging	Security Software Discovery
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates files inside the system directory	System Summary	Masquerading
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
One or more processes crash	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Contains functionality for error logging	System Summary
Contains functionality to create pipes for IPC	Language, Device and Operating System Detection	Process Injection
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary	Security Software Discovery
PE file has a high image base, often used for DLLs	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fxc.exe_d5c59118b01e5ac2e9fe2cdeb3cf1adce977e24e_6f60c9ae_8b4724b5-c86e-4711-b290-a9b5b2b0ec6d\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fxc.exe_d5c59118b01e5ac2e9fe2cdeb3cf1adce977e24e_6f60c9ae_8b4724b5-c86e-4711-b290-a9b5b2b0ec6d\Report.wer
Category:	dropped
Dump:	Report.wer.3.dr
ID:	dr_5
Target ID:	3
Process:	C:\Windows\System32\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.6728573216818682
Encrypted:	false
Ssdeep:	96:6sFb+Ix67sYhqFy7qA8SKQXIDcQTc65cE1cw3u+HbHg/KHnOgrZAX/d5FMT2SlPB:z5x678/U0N9/Dj+zuiF/Z24lO8ID
Size:	65536
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
PE file contains sections with non-standard names	Data Obfuscation
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a high image base, often used for DLLs	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70B6.tmp.dmp

Mini DuMP crash report, 15 streams, Thu Oct 24 10:06:57 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER70B6.tmp.dmp
Category:	dropped
Dump:	WER70B6.tmp.dmp.3.dr
ID:	dr_2
Target ID:	3
Process:	C:\Windows\System32\WerFault.exe
Type:	Mini DuMP crash report, 15 streams, Thu Oct 24 10:06:57 2024, 0x1205a4 type
Entropy:	1.405447527681338
Encrypted:	false
Ssdeep:	96:5w8EH/X74RvrEXi7V1Ii6l1lsUzTBiBgNBhuOWIqsIGKKAeT:REDOV1IhuUzUijXL
Size:	45042
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7105.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER7105.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER7105.tmp.WERInternalMetadata.xml.3.dr
ID:	dr_3
Target ID:	3
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.6882233133926294
Encrypted:	false
Ssdeep:	192:R6l7wVeJTfwr8V6Y9RdLZIgmfDopDa89b8Dkf+0m:R6lXJLwr8V6YbPIgmfDW8gfk
Size:	8548
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7135.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER7135.tmp.xml
Category:	dropped
Dump:	WER7135.tmp.xml.3.dr
ID:	dr_4
Target ID:	3
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.412733950254919
Encrypted:	false
Ssdeep:	48:cvIwWl8zsFJg771I9HyzJWpW8VY6Ym8M4JNXVgFJ8yq8vfXVpuQreTd:uIjffI79s7VaJ28WvuoGd
Size:	4707
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.3.dr
ID:	dr_6
Target ID:	3
Process:	C:\Windows\System32\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.465446814406059
Encrypted:	false
Ssdeep:	6144:gIXfpi67eLPU9skLmb0b4eWSPKaJG8nAgejZMMhA2gX4WABl0uNMdwBCswSbkn:lXD94eWlLZMM6YFHq+kn
Size:	1835008
Whitelisted:	false
Reputation:	low

C:\Windows\debug\fail.txt

ASCII text, with no line terminators

dropped

Details

File:	C:\Windows\debug\fail.txt
Category:	dropped
Dump:	fail.txt.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\fxc.exe
Type:	ASCII text, with no line terminators
Entropy:	3.238901256602631
Encrypted:	false
Ssdeep:	3:5bn:5b
Size:	13
Whitelisted:	false
Reputation:	low

C:\Windows\debug\stop.exe

ASCII text, with no line terminators

dropped

Details

File:	C:\Windows\debug\stop.exe
Category:	dropped
Dump:	stop.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\fxc.exe
Type:	ASCII text, with no line terminators
Entropy:	2.0
Encrypted:	false
Ssdeep:	3:H:H
Size:	4
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\fxc.exe

"C:\Users\user\Desktop\fxc.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7312
Target ID:	0
Parent PID:	2580
Name:	fxc.exe
Path:	C:\Users\user\Desktop\fxc.exe
Commandline:	"C:\Users\user\Desktop\fxc.exe"
Size:	324608
MD5:	0B1904602A90ED190066095F29A3F92A
Time:	06:06:56
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7bc1f0000
Modulesize:	344064
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
PE file contains sections with non-standard names	Data Obfuscation
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a high image base, often used for DLLs	System Summary

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 7312 -s 232

Details

Is windows:	true
Is dropped:	false
PID:	7388
Target ID:	3
Parent PID:	7312
Name:	WerFault.exe
Path:	C:\Windows\System32\WerFault.exe
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7312 -s 232
Size:	570736
MD5:	FD27D9F6D02763BDE32511B5DF7FF7A0
Time:	06:06:57
Date:	24/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6e4b30000
Modulesize:	581632
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://upx.sf.net

unknown