Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
Resource
win10v20201028
General
-
Target
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
-
Size
1.2MB
-
MD5
b7c64961404b11332ce76a067eb3d1d0
-
SHA1
7781a5b8c7d8f318514188d67b50000bcd022dfc
-
SHA256
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
-
SHA512
72a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
wsapx.exewsapx.exepid process 752 wsapx.exe 1584 wsapx.exe -
Loads dropped DLL 6 IoCs
Processes:
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exeWerFault.exepid process 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wsapx.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\wsapx = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\wsapx.exe\"" wsapx.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1588 752 WerFault.exe wsapx.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1500 schtasks.exe 1764 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exewsapx.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe Token: SeDebugPrivilege 752 wsapx.exe Token: SeDebugPrivilege 1588 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wsapx.exepid process 752 wsapx.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exewsapx.execmd.exedescription pid process target process PID 1040 wrote to memory of 1500 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe schtasks.exe PID 1040 wrote to memory of 1500 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe schtasks.exe PID 1040 wrote to memory of 1500 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe schtasks.exe PID 1040 wrote to memory of 1500 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe schtasks.exe PID 1040 wrote to memory of 752 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe wsapx.exe PID 1040 wrote to memory of 752 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe wsapx.exe PID 1040 wrote to memory of 752 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe wsapx.exe PID 1040 wrote to memory of 752 1040 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe wsapx.exe PID 752 wrote to memory of 1764 752 wsapx.exe schtasks.exe PID 752 wrote to memory of 1764 752 wsapx.exe schtasks.exe PID 752 wrote to memory of 1764 752 wsapx.exe schtasks.exe PID 752 wrote to memory of 1764 752 wsapx.exe schtasks.exe PID 752 wrote to memory of 692 752 wsapx.exe cmd.exe PID 752 wrote to memory of 692 752 wsapx.exe cmd.exe PID 752 wrote to memory of 692 752 wsapx.exe cmd.exe PID 752 wrote to memory of 692 752 wsapx.exe cmd.exe PID 692 wrote to memory of 1704 692 cmd.exe chcp.com PID 692 wrote to memory of 1704 692 cmd.exe chcp.com PID 692 wrote to memory of 1704 692 cmd.exe chcp.com PID 692 wrote to memory of 1704 692 cmd.exe chcp.com PID 692 wrote to memory of 1008 692 cmd.exe PING.EXE PID 692 wrote to memory of 1008 692 cmd.exe PING.EXE PID 692 wrote to memory of 1008 692 cmd.exe PING.EXE PID 692 wrote to memory of 1008 692 cmd.exe PING.EXE PID 752 wrote to memory of 1588 752 wsapx.exe WerFault.exe PID 752 wrote to memory of 1588 752 wsapx.exe WerFault.exe PID 752 wrote to memory of 1588 752 wsapx.exe WerFault.exe PID 752 wrote to memory of 1588 752 wsapx.exe WerFault.exe PID 692 wrote to memory of 1584 692 cmd.exe wsapx.exe PID 692 wrote to memory of 1584 692 cmd.exe wsapx.exe PID 692 wrote to memory of 1584 692 cmd.exe wsapx.exe PID 692 wrote to memory of 1584 692 cmd.exe wsapx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe"C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "wsapx" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "wsapx" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\fHwC3ehSt55G.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 14323⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fHwC3ehSt55G.batMD5
c5644f4e9a82863f06792c01cb23f310
SHA1b26be7fe7d97b08d5e4e237be1f60d66f5372c6f
SHA256f214f581f0f6a96450b440e2c6d4acc24b2184be0ead6f1a347fae53e97475f4
SHA51283d665d87b1cdbd896d1c8010967c86a2b1f1daa0af5b3b48d0536dd25d94d8d1870df66fd30cc25ed7c24b5e1ef0cca3c31005fd7f0147cb8811285848ebfaa
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
memory/692-18-0x0000000000000000-mapping.dmp
-
memory/752-16-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/752-13-0x0000000001390000-0x0000000001391000-memory.dmpFilesize
4KB
-
memory/752-12-0x00000000745B0000-0x0000000074C9E000-memory.dmpFilesize
6.9MB
-
memory/752-9-0x0000000000000000-mapping.dmp
-
memory/1008-21-0x0000000000000000-mapping.dmp
-
memory/1040-6-0x0000000000A60000-0x0000000000A70000-memory.dmpFilesize
64KB
-
memory/1040-2-0x00000000745B0000-0x0000000074C9E000-memory.dmpFilesize
6.9MB
-
memory/1040-3-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/1040-5-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/1500-7-0x0000000000000000-mapping.dmp
-
memory/1584-36-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/1584-30-0x0000000000000000-mapping.dmp
-
memory/1584-32-0x00000000745B0000-0x0000000074C9E000-memory.dmpFilesize
6.9MB
-
memory/1588-22-0x0000000000000000-mapping.dmp
-
memory/1588-29-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1588-23-0x0000000002350000-0x0000000002361000-memory.dmpFilesize
68KB
-
memory/1704-20-0x0000000000000000-mapping.dmp
-
memory/1764-17-0x0000000000000000-mapping.dmp