Analysis
- max time kernel
127s - max time network
130s - platform
windows10_x64 - resource
win10v20201028 - submitted
21/02/2021, 07:39
General
- Target 0a06a353a2e49918aab6f402ba40fa54.exe
- Size 620KB
- Sample210221-pf3ff198w2
- SHA256 d9ac88bfd85d3868d4e732d0a65b3bee2678213467f38aec3c3bd2017355b1ac
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 11 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a06a353a2e49918aab6f402ba40fa54.exe"C:\Users\Admin\AppData\Local\Temp\0a06a353a2e49918aab6f402ba40fa54.exe"1⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 8402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 12122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 15722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 15402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 16442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 18762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 18802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 14082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 15522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 19562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/200-11-0x0000000004380000-0x0000000004381000-memory.dmp
memory/1400-23-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/2300-14-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
memory/2424-29-0x0000000004090000-0x0000000004091000-memory.dmp
memory/2704-32-0x0000000004960000-0x0000000004961000-memory.dmp
memory/2920-17-0x0000000004370000-0x0000000004371000-memory.dmp
memory/3160-35-0x00000000045B0000-0x00000000045B1000-memory.dmp
memory/3192-20-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/3416-8-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/3792-6-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/3792-5-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/3940-26-0x0000000004530000-0x0000000004531000-memory.dmp
memory/3992-2-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/3992-4-0x0000000000400000-0x00000000004D5000-memory.dmp
memory/3992-3-0x0000000002D80000-0x0000000002E4F000-memory.dmp