Overview
overview
10Static
static
804443c70d3...be.exe
windows7_x64
904443c70d3...be.exe
windows10_x64
905535d72f3...06.exe
windows7_x64
105535d72f3...06.exe
windows10_x64
11bec139d54...72.exe
windows7_x64
81bec139d54...72.exe
windows10_x64
81f670ff8cc...55.exe
windows7_x64
11f670ff8cc...55.exe
windows10_x64
12deaa0ec74...ea.exe
windows7_x64
102deaa0ec74...ea.exe
windows10_x64
10372b929ae9...ef.dll
windows7_x64
9372b929ae9...ef.dll
windows10_x64
938ee6bea62...15.exe
windows7_x64
338ee6bea62...15.exe
windows10_x64
3437d91ce52...8f.exe
windows7_x64
1437d91ce52...8f.exe
windows10_x64
4447058c1c6...a8.exe
windows7_x64
9447058c1c6...a8.exe
windows10_x64
95061c0b08d...03.exe
windows7_x64
15061c0b08d...03.exe
windows10_x64
15ed4b682ef...d4.exe
windows7_x64
85ed4b682ef...d4.exe
windows10_x64
86970600d21...b5.exe
windows7_x64
16970600d21...b5.exe
windows10_x64
172f528f9a6...92.exe
windows7_x64
872f528f9a6...92.exe
windows10_x64
873dcee7abe...99.exe
windows7_x64
173dcee7abe...99.exe
windows10_x64
17e118b534a...d2.exe
windows7_x64
107e118b534a...d2.exe
windows10_x64
108034fffb03...3c.exe
windows7_x64
108034fffb03...3c.exe
windows10_x64
10Analysis
-
max time kernel
144s -
max time network
106s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-03-2021 09:49
Static task
static1
Behavioral task
behavioral1
Sample
04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
05535d72f3f98c73d9b660625e1b627b1bebbd15d7d4add4ecc492a2b0d67a06.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
05535d72f3f98c73d9b660625e1b627b1bebbd15d7d4add4ecc492a2b0d67a06.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
1bec139d54d147196c4e736d8dcf1f39d2bff390d59d5b240b4a97e03763cf72.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
1bec139d54d147196c4e736d8dcf1f39d2bff390d59d5b240b4a97e03763cf72.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
1f670ff8cca59a61aa0d58f297788916a6a9a318c1e7a3319367b6ffdc45c755.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
1f670ff8cca59a61aa0d58f297788916a6a9a318c1e7a3319367b6ffdc45c755.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral16
Sample
437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
447058c1c6551c352895be7569e33c96384da3757303fc97004be45f56b4e9a8.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral18
Sample
447058c1c6551c352895be7569e33c96384da3757303fc97004be45f56b4e9a8.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
5061c0b08d522fdae45fc9285ac45fb96a4e80bd859867a0e988dfaeb2b33b03.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral20
Sample
5061c0b08d522fdae45fc9285ac45fb96a4e80bd859867a0e988dfaeb2b33b03.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral22
Sample
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
6970600d21285371d6a4fd6175b65b672b9b9aaea36353e1544f0672944c9fb5.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral24
Sample
6970600d21285371d6a4fd6175b65b672b9b9aaea36353e1544f0672944c9fb5.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral26
Sample
72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
73dcee7abeca24a9170f800d069e80283b9ea1bd7cc6fbabdf55c613897f9699.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral28
Sample
73dcee7abeca24a9170f800d069e80283b9ea1bd7cc6fbabdf55c613897f9699.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral30
Sample
7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
8034fffb03faec5aa94d3c16cdb98dfbcce06e8f8f7a278f7c30cff0398ea03c.exe
Resource
win7v20201028
windows7_x64
General
-
Target
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe
-
Size
611KB
-
MD5
646a7f19343274ba87dbddc903dd60d0
-
SHA1
eb84789fda3ad3fa6e838c954e1ac0d1e9fd2848
-
SHA256
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4
-
SHA512
3589d32cce5620232b2b6e7b6fc4f64fad7cf7b0ff95bd161913f8f59b45a086c9d93aa453dbc6f4d9b63b40b7a3e1101f09fe6ee5bcd997de1177a5d798c362
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1508 dicabfcedb.exe -
Loads dropped DLL 10 IoCs
pid Process 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1836 1508 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1964 wmic.exe Token: SeSecurityPrivilege 1964 wmic.exe Token: SeTakeOwnershipPrivilege 1964 wmic.exe Token: SeLoadDriverPrivilege 1964 wmic.exe Token: SeSystemProfilePrivilege 1964 wmic.exe Token: SeSystemtimePrivilege 1964 wmic.exe Token: SeProfSingleProcessPrivilege 1964 wmic.exe Token: SeIncBasePriorityPrivilege 1964 wmic.exe Token: SeCreatePagefilePrivilege 1964 wmic.exe Token: SeBackupPrivilege 1964 wmic.exe Token: SeRestorePrivilege 1964 wmic.exe Token: SeShutdownPrivilege 1964 wmic.exe Token: SeDebugPrivilege 1964 wmic.exe Token: SeSystemEnvironmentPrivilege 1964 wmic.exe Token: SeRemoteShutdownPrivilege 1964 wmic.exe Token: SeUndockPrivilege 1964 wmic.exe Token: SeManageVolumePrivilege 1964 wmic.exe Token: 33 1964 wmic.exe Token: 34 1964 wmic.exe Token: 35 1964 wmic.exe Token: SeIncreaseQuotaPrivilege 1964 wmic.exe Token: SeSecurityPrivilege 1964 wmic.exe Token: SeTakeOwnershipPrivilege 1964 wmic.exe Token: SeLoadDriverPrivilege 1964 wmic.exe Token: SeSystemProfilePrivilege 1964 wmic.exe Token: SeSystemtimePrivilege 1964 wmic.exe Token: SeProfSingleProcessPrivilege 1964 wmic.exe Token: SeIncBasePriorityPrivilege 1964 wmic.exe Token: SeCreatePagefilePrivilege 1964 wmic.exe Token: SeBackupPrivilege 1964 wmic.exe Token: SeRestorePrivilege 1964 wmic.exe Token: SeShutdownPrivilege 1964 wmic.exe Token: SeDebugPrivilege 1964 wmic.exe Token: SeSystemEnvironmentPrivilege 1964 wmic.exe Token: SeRemoteShutdownPrivilege 1964 wmic.exe Token: SeUndockPrivilege 1964 wmic.exe Token: SeManageVolumePrivilege 1964 wmic.exe Token: 33 1964 wmic.exe Token: 34 1964 wmic.exe Token: 35 1964 wmic.exe Token: SeIncreaseQuotaPrivilege 1064 wmic.exe Token: SeSecurityPrivilege 1064 wmic.exe Token: SeTakeOwnershipPrivilege 1064 wmic.exe Token: SeLoadDriverPrivilege 1064 wmic.exe Token: SeSystemProfilePrivilege 1064 wmic.exe Token: SeSystemtimePrivilege 1064 wmic.exe Token: SeProfSingleProcessPrivilege 1064 wmic.exe Token: SeIncBasePriorityPrivilege 1064 wmic.exe Token: SeCreatePagefilePrivilege 1064 wmic.exe Token: SeBackupPrivilege 1064 wmic.exe Token: SeRestorePrivilege 1064 wmic.exe Token: SeShutdownPrivilege 1064 wmic.exe Token: SeDebugPrivilege 1064 wmic.exe Token: SeSystemEnvironmentPrivilege 1064 wmic.exe Token: SeRemoteShutdownPrivilege 1064 wmic.exe Token: SeUndockPrivilege 1064 wmic.exe Token: SeManageVolumePrivilege 1064 wmic.exe Token: 33 1064 wmic.exe Token: 34 1064 wmic.exe Token: 35 1064 wmic.exe Token: SeIncreaseQuotaPrivilege 1064 wmic.exe Token: SeSecurityPrivilege 1064 wmic.exe Token: SeTakeOwnershipPrivilege 1064 wmic.exe Token: SeLoadDriverPrivilege 1064 wmic.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 336 wrote to memory of 1508 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 26 PID 336 wrote to memory of 1508 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 26 PID 336 wrote to memory of 1508 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 26 PID 336 wrote to memory of 1508 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 26 PID 336 wrote to memory of 1508 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 26 PID 336 wrote to memory of 1508 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 26 PID 336 wrote to memory of 1508 336 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 26 PID 1508 wrote to memory of 1964 1508 dicabfcedb.exe 27 PID 1508 wrote to memory of 1964 1508 dicabfcedb.exe 27 PID 1508 wrote to memory of 1964 1508 dicabfcedb.exe 27 PID 1508 wrote to memory of 1964 1508 dicabfcedb.exe 27 PID 1508 wrote to memory of 1064 1508 dicabfcedb.exe 33 PID 1508 wrote to memory of 1064 1508 dicabfcedb.exe 33 PID 1508 wrote to memory of 1064 1508 dicabfcedb.exe 33 PID 1508 wrote to memory of 1064 1508 dicabfcedb.exe 33 PID 1508 wrote to memory of 364 1508 dicabfcedb.exe 35 PID 1508 wrote to memory of 364 1508 dicabfcedb.exe 35 PID 1508 wrote to memory of 364 1508 dicabfcedb.exe 35 PID 1508 wrote to memory of 364 1508 dicabfcedb.exe 35 PID 1508 wrote to memory of 544 1508 dicabfcedb.exe 37 PID 1508 wrote to memory of 544 1508 dicabfcedb.exe 37 PID 1508 wrote to memory of 544 1508 dicabfcedb.exe 37 PID 1508 wrote to memory of 544 1508 dicabfcedb.exe 37 PID 1508 wrote to memory of 340 1508 dicabfcedb.exe 39 PID 1508 wrote to memory of 340 1508 dicabfcedb.exe 39 PID 1508 wrote to memory of 340 1508 dicabfcedb.exe 39 PID 1508 wrote to memory of 340 1508 dicabfcedb.exe 39 PID 1508 wrote to memory of 1836 1508 dicabfcedb.exe 41 PID 1508 wrote to memory of 1836 1508 dicabfcedb.exe 41 PID 1508 wrote to memory of 1836 1508 dicabfcedb.exe 41 PID 1508 wrote to memory of 1836 1508 dicabfcedb.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe"C:\Users\Admin\AppData\Local\Temp\5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\dicabfcedb.exeC:\Users\Admin\AppData\Local\Temp\dicabfcedb.exe 9-8-2-6-0-2-2-7-4-7-9 JkhHPj01Nik1GSZKTUBKSUI7KRwoRTxMVUlSSUc9OSoXJjxHTVRHQjYtKS0uLR4pQ0dCNiwZJkdKTT5VQVJYRT00KCgvKzkeLUxBS008Sl1PUko7YXBtZzEnLW1lcHQncGFcJFluai1iX21dJ2BlXm0aL0FKQj9EQDs1HilELzsrLCknFydCLD0rLxkrPSo0JS8aL0IyNikqFyY8MzctLx4oTEtGO01BTl9OUEJSOjpQNR4pUFBNPVE8S1Y9U0ZBOx4oTEtGO01BTl9MP0ZBNjpYZGNoZF9wHi4pQGRobWx0K0NxbGhpax0wKmZtcB4uKUZsbGppb2keKEFRPFZNUEY9ZnJtbDMmJlxqKHRtblpobSVaZ2spY19qYmFYalxsc2ouY3ZeHCg8Tz1dPU1CSkJKPjQXJ0ZJU1JdO05ITko9UDc1Hi1NRDpFQlFNT19TUEU5YWtraDgpL3BjaWsnW2ZvbGZvX2ImdmhlXCZhaS9ycFpfZCZgZnFuYWpqJ2xhZzZocGlkc2FtalpkXDVBW2xjbF1dayJAZW5pcnIrPnRpZmlsKWBvcClIcW1jZmdpIGZnal5qWmRcNUFbbGNsXV1rIkBlbmlycis+dGlmaWwpYG9wKUhxbWNmZ2kaL1RLNi4ZJjtLLzcgLVBOSk1ARD1dUUVKQUhJPkBEOUU/VVBKNhwoQEpXUE9OUkdGQTZraW1jGi9QQ01RS0VARkVZVVFDS1s9OFBLOywgLUZCQD5PNCkeKUlRXT1VRzhEQUFZRUxBS1VJSzw8O2BhanFeHCg7Rk9MRk8/QlhFSTQsLCwrOTYsKjErJSgtNxovUkdGQTYoKyozMjI0Ni8sGSY7R1VITE0/PVtNQEQ9Oy0vNi0rLCosISs4KjE4LikmSUQ=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615805184.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615805184.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615805184.txt bios get version3⤵PID:364
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615805184.txt bios get version3⤵PID:544
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615805184.txt bios get version3⤵PID:340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 3723⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-