Overview
overview
10Static
static
804443c70d3...be.exe
windows7_x64
904443c70d3...be.exe
windows10_x64
905535d72f3...06.exe
windows7_x64
105535d72f3...06.exe
windows10_x64
11bec139d54...72.exe
windows7_x64
81bec139d54...72.exe
windows10_x64
81f670ff8cc...55.exe
windows7_x64
11f670ff8cc...55.exe
windows10_x64
12deaa0ec74...ea.exe
windows7_x64
102deaa0ec74...ea.exe
windows10_x64
10372b929ae9...ef.dll
windows7_x64
9372b929ae9...ef.dll
windows10_x64
938ee6bea62...15.exe
windows7_x64
338ee6bea62...15.exe
windows10_x64
3437d91ce52...8f.exe
windows7_x64
1437d91ce52...8f.exe
windows10_x64
4447058c1c6...a8.exe
windows7_x64
9447058c1c6...a8.exe
windows10_x64
95061c0b08d...03.exe
windows7_x64
15061c0b08d...03.exe
windows10_x64
15ed4b682ef...d4.exe
windows7_x64
85ed4b682ef...d4.exe
windows10_x64
86970600d21...b5.exe
windows7_x64
16970600d21...b5.exe
windows10_x64
172f528f9a6...92.exe
windows7_x64
872f528f9a6...92.exe
windows10_x64
873dcee7abe...99.exe
windows7_x64
173dcee7abe...99.exe
windows10_x64
17e118b534a...d2.exe
windows7_x64
107e118b534a...d2.exe
windows10_x64
108034fffb03...3c.exe
windows7_x64
108034fffb03...3c.exe
windows10_x64
10Analysis
-
max time kernel
140s -
max time network
105s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-03-2021 09:49
Static task
static1
Behavioral task
behavioral1
Sample
04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
05535d72f3f98c73d9b660625e1b627b1bebbd15d7d4add4ecc492a2b0d67a06.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
05535d72f3f98c73d9b660625e1b627b1bebbd15d7d4add4ecc492a2b0d67a06.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
1bec139d54d147196c4e736d8dcf1f39d2bff390d59d5b240b4a97e03763cf72.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
1bec139d54d147196c4e736d8dcf1f39d2bff390d59d5b240b4a97e03763cf72.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
1f670ff8cca59a61aa0d58f297788916a6a9a318c1e7a3319367b6ffdc45c755.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
1f670ff8cca59a61aa0d58f297788916a6a9a318c1e7a3319367b6ffdc45c755.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral16
Sample
437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
447058c1c6551c352895be7569e33c96384da3757303fc97004be45f56b4e9a8.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral18
Sample
447058c1c6551c352895be7569e33c96384da3757303fc97004be45f56b4e9a8.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
5061c0b08d522fdae45fc9285ac45fb96a4e80bd859867a0e988dfaeb2b33b03.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral20
Sample
5061c0b08d522fdae45fc9285ac45fb96a4e80bd859867a0e988dfaeb2b33b03.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral22
Sample
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
6970600d21285371d6a4fd6175b65b672b9b9aaea36353e1544f0672944c9fb5.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral24
Sample
6970600d21285371d6a4fd6175b65b672b9b9aaea36353e1544f0672944c9fb5.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral26
Sample
72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
73dcee7abeca24a9170f800d069e80283b9ea1bd7cc6fbabdf55c613897f9699.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral28
Sample
73dcee7abeca24a9170f800d069e80283b9ea1bd7cc6fbabdf55c613897f9699.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral30
Sample
7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
8034fffb03faec5aa94d3c16cdb98dfbcce06e8f8f7a278f7c30cff0398ea03c.exe
Resource
win7v20201028
windows7_x64
General
-
Target
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe
-
Size
611KB
-
MD5
646a7f19343274ba87dbddc903dd60d0
-
SHA1
eb84789fda3ad3fa6e838c954e1ac0d1e9fd2848
-
SHA256
5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4
-
SHA512
3589d32cce5620232b2b6e7b6fc4f64fad7cf7b0ff95bd161913f8f59b45a086c9d93aa453dbc6f4d9b63b40b7a3e1101f09fe6ee5bcd997de1177a5d798c362
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3960 dicabfcedb.exe -
Loads dropped DLL 2 IoCs
pid Process 644 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 644 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2656 3960 WerFault.exe 74 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4028 wmic.exe Token: SeSecurityPrivilege 4028 wmic.exe Token: SeTakeOwnershipPrivilege 4028 wmic.exe Token: SeLoadDriverPrivilege 4028 wmic.exe Token: SeSystemProfilePrivilege 4028 wmic.exe Token: SeSystemtimePrivilege 4028 wmic.exe Token: SeProfSingleProcessPrivilege 4028 wmic.exe Token: SeIncBasePriorityPrivilege 4028 wmic.exe Token: SeCreatePagefilePrivilege 4028 wmic.exe Token: SeBackupPrivilege 4028 wmic.exe Token: SeRestorePrivilege 4028 wmic.exe Token: SeShutdownPrivilege 4028 wmic.exe Token: SeDebugPrivilege 4028 wmic.exe Token: SeSystemEnvironmentPrivilege 4028 wmic.exe Token: SeRemoteShutdownPrivilege 4028 wmic.exe Token: SeUndockPrivilege 4028 wmic.exe Token: SeManageVolumePrivilege 4028 wmic.exe Token: 33 4028 wmic.exe Token: 34 4028 wmic.exe Token: 35 4028 wmic.exe Token: 36 4028 wmic.exe Token: SeIncreaseQuotaPrivilege 4028 wmic.exe Token: SeSecurityPrivilege 4028 wmic.exe Token: SeTakeOwnershipPrivilege 4028 wmic.exe Token: SeLoadDriverPrivilege 4028 wmic.exe Token: SeSystemProfilePrivilege 4028 wmic.exe Token: SeSystemtimePrivilege 4028 wmic.exe Token: SeProfSingleProcessPrivilege 4028 wmic.exe Token: SeIncBasePriorityPrivilege 4028 wmic.exe Token: SeCreatePagefilePrivilege 4028 wmic.exe Token: SeBackupPrivilege 4028 wmic.exe Token: SeRestorePrivilege 4028 wmic.exe Token: SeShutdownPrivilege 4028 wmic.exe Token: SeDebugPrivilege 4028 wmic.exe Token: SeSystemEnvironmentPrivilege 4028 wmic.exe Token: SeRemoteShutdownPrivilege 4028 wmic.exe Token: SeUndockPrivilege 4028 wmic.exe Token: SeManageVolumePrivilege 4028 wmic.exe Token: 33 4028 wmic.exe Token: 34 4028 wmic.exe Token: 35 4028 wmic.exe Token: 36 4028 wmic.exe Token: SeIncreaseQuotaPrivilege 3180 wmic.exe Token: SeSecurityPrivilege 3180 wmic.exe Token: SeTakeOwnershipPrivilege 3180 wmic.exe Token: SeLoadDriverPrivilege 3180 wmic.exe Token: SeSystemProfilePrivilege 3180 wmic.exe Token: SeSystemtimePrivilege 3180 wmic.exe Token: SeProfSingleProcessPrivilege 3180 wmic.exe Token: SeIncBasePriorityPrivilege 3180 wmic.exe Token: SeCreatePagefilePrivilege 3180 wmic.exe Token: SeBackupPrivilege 3180 wmic.exe Token: SeRestorePrivilege 3180 wmic.exe Token: SeShutdownPrivilege 3180 wmic.exe Token: SeDebugPrivilege 3180 wmic.exe Token: SeSystemEnvironmentPrivilege 3180 wmic.exe Token: SeRemoteShutdownPrivilege 3180 wmic.exe Token: SeUndockPrivilege 3180 wmic.exe Token: SeManageVolumePrivilege 3180 wmic.exe Token: 33 3180 wmic.exe Token: 34 3180 wmic.exe Token: 35 3180 wmic.exe Token: 36 3180 wmic.exe Token: SeIncreaseQuotaPrivilege 3180 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 644 wrote to memory of 3960 644 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 74 PID 644 wrote to memory of 3960 644 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 74 PID 644 wrote to memory of 3960 644 5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe 74 PID 3960 wrote to memory of 4028 3960 dicabfcedb.exe 75 PID 3960 wrote to memory of 4028 3960 dicabfcedb.exe 75 PID 3960 wrote to memory of 4028 3960 dicabfcedb.exe 75 PID 3960 wrote to memory of 3180 3960 dicabfcedb.exe 78 PID 3960 wrote to memory of 3180 3960 dicabfcedb.exe 78 PID 3960 wrote to memory of 3180 3960 dicabfcedb.exe 78 PID 3960 wrote to memory of 2724 3960 dicabfcedb.exe 80 PID 3960 wrote to memory of 2724 3960 dicabfcedb.exe 80 PID 3960 wrote to memory of 2724 3960 dicabfcedb.exe 80 PID 3960 wrote to memory of 200 3960 dicabfcedb.exe 82 PID 3960 wrote to memory of 200 3960 dicabfcedb.exe 82 PID 3960 wrote to memory of 200 3960 dicabfcedb.exe 82 PID 3960 wrote to memory of 2720 3960 dicabfcedb.exe 84 PID 3960 wrote to memory of 2720 3960 dicabfcedb.exe 84 PID 3960 wrote to memory of 2720 3960 dicabfcedb.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe"C:\Users\Admin\AppData\Local\Temp\5ed4b682efcc4d63e5fc8a5f666f64e206e710dd408455d6061ddf3d8c95aed4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\dicabfcedb.exeC:\Users\Admin\AppData\Local\Temp\dicabfcedb.exe 9-8-2-6-0-2-2-7-4-7-9 JkhHPj01Nik1GSZKTUBKSUI7KRwoRTxMVUlSSUc9OSoXJjxHTVRHQjYtKS0uLR4pQ0dCNiwZJkdKTT5VQVJYRT00KCgvKzkeLUxBS008Sl1PUko7YXBtZzEnLW1lcHQncGFcJFluai1iX21dJ2BlXm0aL0FKQj9EQDs1HilELzsrLCknFydCLD0rLxkrPSo0JS8aL0IyNikqFyY8MzctLx4oTEtGO01BTl9OUEJSOjpQNR4pUFBNPVE8S1Y9U0ZBOx4oTEtGO01BTl9MP0ZBNjpYZGNoZF9wHi4pQGRobWx0K0NxbGhpax0wKmZtcB4uKUZsbGppb2keKEFRPFZNUEY9ZnJtbDMmJlxqKHRtblpobSVaZ2spY19qYmFYalxsc2ouY3ZeHCg8Tz1dPU1CSkJKPjQXJ0ZJU1JdO05ITko9UDc1Hi1NRDpFQlFNT19TUEU5YWtraDgpL3BjaWsnW2ZvbGZvX2ImdmhlXCZhaS9ycFpfZCZgZnFuYWpqJ2xhZzZocGlkc2FtalpkXDVBW2xjbF1dayJAZW5pcnIrPnRpZmlsKWBvcClIcW1jZmdpIGZnal5qWmRcNUFbbGNsXV1rIkBlbmlycis+dGlmaWwpYG9wKUhxbWNmZ2kaL1RLNi4ZJjtLLzcgLVBOSk1ARD1dUUVKQUhJPkBEOUU/VVBKNhwoQEpXUE9OUkdGQTZraW1jGi9QQ01RS0VARkVZVVFDS1s9OFBLOywgLUZCQD5PNCkeKUlRXT1VRzhEQUFZRUxBS1VJSzw8O2BhanFeHCg7Rk9MRk8/QlhFSTQsLCwrOTYsKjErJSgtNxovUkdGQTYoKyozMjI0Ni8sGSY7R1VITE0/PVtNQEQ9Oy0vNi0rLCosISs4KjE4LikmSUQ=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615801579.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615801579.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615801579.txt bios get version3⤵PID:2724
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615801579.txt bios get version3⤵PID:200
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81615801579.txt bios get version3⤵PID:2720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 9483⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:2656
-
-