Analysis
-
max time kernel
18s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
Resource
win10v20201028
General
-
Target
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
-
Size
1.2MB
-
MD5
b7c64961404b11332ce76a067eb3d1d0
-
SHA1
7781a5b8c7d8f318514188d67b50000bcd022dfc
-
SHA256
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
-
SHA512
72a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
wsapx.exewsapx.exepid process 940 wsapx.exe 2452 wsapx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wsapx.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\wsapx = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\wsapx.exe\"" wsapx.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3180 940 WerFault.exe wsapx.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exewsapx.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1032 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe Token: SeDebugPrivilege 940 wsapx.exe Token: SeRestorePrivilege 3180 WerFault.exe Token: SeBackupPrivilege 3180 WerFault.exe Token: SeDebugPrivilege 3180 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wsapx.exepid process 940 wsapx.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exewsapx.execmd.exedescription pid process target process PID 1032 wrote to memory of 2284 1032 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe schtasks.exe PID 1032 wrote to memory of 2284 1032 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe schtasks.exe PID 1032 wrote to memory of 2284 1032 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe schtasks.exe PID 1032 wrote to memory of 940 1032 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe wsapx.exe PID 1032 wrote to memory of 940 1032 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe wsapx.exe PID 1032 wrote to memory of 940 1032 a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe wsapx.exe PID 940 wrote to memory of 648 940 wsapx.exe schtasks.exe PID 940 wrote to memory of 648 940 wsapx.exe schtasks.exe PID 940 wrote to memory of 648 940 wsapx.exe schtasks.exe PID 940 wrote to memory of 3960 940 wsapx.exe cmd.exe PID 940 wrote to memory of 3960 940 wsapx.exe cmd.exe PID 940 wrote to memory of 3960 940 wsapx.exe cmd.exe PID 3960 wrote to memory of 2592 3960 cmd.exe chcp.com PID 3960 wrote to memory of 2592 3960 cmd.exe chcp.com PID 3960 wrote to memory of 2592 3960 cmd.exe chcp.com PID 3960 wrote to memory of 3184 3960 cmd.exe PING.EXE PID 3960 wrote to memory of 3184 3960 cmd.exe PING.EXE PID 3960 wrote to memory of 3184 3960 cmd.exe PING.EXE PID 3960 wrote to memory of 2452 3960 cmd.exe wsapx.exe PID 3960 wrote to memory of 2452 3960 cmd.exe wsapx.exe PID 3960 wrote to memory of 2452 3960 cmd.exe wsapx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe"C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "wsapx" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "wsapx" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ydK6WMkAwEZB.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 22083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ydK6WMkAwEZB.batMD5
c97e2ab647d7d834cdc3bdae3d1a9810
SHA1d006e6ec41a5d3a33c431f3c1e55658c4cd0ea6a
SHA256df6a5542656b81042d5ebd45c8f7ee02aadcff15349b1a1b755ea7264e0d3c7e
SHA5126e71f3c051725baa231f2dc2046b91450de4369b0871a3cbc72c23a1341b27e1a08bc556cc1faf4a38b86e2ea0f143d702444ff1fa7828107e4e126ce9549e62
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exeMD5
b7c64961404b11332ce76a067eb3d1d0
SHA17781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA51272a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6
-
memory/648-26-0x0000000000000000-mapping.dmp
-
memory/940-13-0x0000000000000000-mapping.dmp
-
memory/940-28-0x0000000006410000-0x0000000006411000-memory.dmpFilesize
4KB
-
memory/940-27-0x0000000006490000-0x0000000006491000-memory.dmpFilesize
4KB
-
memory/940-23-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/940-16-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/1032-9-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/1032-5-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/1032-11-0x00000000066D0000-0x00000000066D1000-memory.dmpFilesize
4KB
-
memory/1032-10-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1032-2-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/1032-8-0x0000000005970000-0x0000000005971000-memory.dmpFilesize
4KB
-
memory/1032-7-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/1032-6-0x0000000005180000-0x0000000005190000-memory.dmpFilesize
64KB
-
memory/1032-3-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/2284-12-0x0000000000000000-mapping.dmp
-
memory/2452-34-0x0000000000000000-mapping.dmp
-
memory/2452-36-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/2452-43-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/2592-31-0x0000000000000000-mapping.dmp
-
memory/3180-33-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/3184-32-0x0000000000000000-mapping.dmp
-
memory/3960-29-0x0000000000000000-mapping.dmp