Analysis
-
max time kernel
34s -
max time network
99s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-02-2021 19:37
Static task
static1
Behavioral task
behavioral1
Sample
NEW SC.cmd.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NEW SC.cmd.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
NEW SC.cmd.exe
-
Size
14KB
-
MD5
870ffbc1a133083f10fadf93cf28f706
-
SHA1
eddbe2346d62a6925634abd5dfe2d6f6b0ff3a5b
-
SHA256
f49c3157e749609acf89ae453958b7d4f1fc165941e6e998271b0caee1f0cf35
-
SHA512
f6b65b12ccadc42cfecc2130399cab9beadf4447dfbae09c523c3e7dc7eacf881be2d7590942f49e1270c3d8c3d793cfb293006696300c56ab5320b66d8f835b
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2064 1180 WerFault.exe NEW SC.cmd.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 184 timeout.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe 2064 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
NEW SC.cmd.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1180 NEW SC.cmd.exe Token: SeRestorePrivilege 2064 WerFault.exe Token: SeBackupPrivilege 2064 WerFault.exe Token: SeDebugPrivilege 2064 WerFault.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
NEW SC.cmd.execmd.exedescription pid process target process PID 1180 wrote to memory of 2656 1180 NEW SC.cmd.exe cmd.exe PID 1180 wrote to memory of 2656 1180 NEW SC.cmd.exe cmd.exe PID 1180 wrote to memory of 2656 1180 NEW SC.cmd.exe cmd.exe PID 2656 wrote to memory of 184 2656 cmd.exe timeout.exe PID 2656 wrote to memory of 184 2656 cmd.exe timeout.exe PID 2656 wrote to memory of 184 2656 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe"C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.6382⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 4.6383⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 19642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/184-7-0x0000000000000000-mapping.dmp
-
memory/1180-2-0x0000000073D20000-0x000000007440E000-memory.dmpFilesize
6.9MB
-
memory/1180-3-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB
-
memory/1180-5-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/1180-8-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/2064-9-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/2064-10-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/2656-6-0x0000000000000000-mapping.dmp