2edd49d375ebc4673d759b8a135bced75c0ffb3c2e5b2e924ee2a6ed521d575a

General

Target

1234.exe
Size

1.2MB
MD5

45de46aae024150078e249dec173a337
SHA1

bd1f8891836765f1c58777806cb82657b8c3bd7e
SHA256

554ac14fb25de9add3d66f0877a7da079bf6818a4957a21b2a618c6aac22b6c4
SHA512

2bb1d4d1908cc2534677f32861dd0185c2907508112d05434d731088a62f9f28071e8652111c2745dad28d4334c696471dc358ca9537b08e390157d5502def24

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

SystemLanguageDriverver2.31.exe

pid process

1468 SystemLanguageDriverver2.31.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1596 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1172 368 WerFault.exe 1234.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1044 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

848 timeout.exe

pid	process
1468	SystemLanguageDriverver2.31.exe

pid	process
1596	cmd.exe

pid	pid_target	process	target process
1172	368	WerFault.exe	1234.exe

pid	process
1044	schtasks.exe

pid	process
848	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

SystemLanguageDriverver2.31.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	SystemLanguageDriverver2.31.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	SystemLanguageDriverver2.31.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

WerFault.exe1234.exetaskmgr.exe

pid	process
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1972	1234.exe
1972	1234.exe
1972	1234.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

WerFault.exerundll32.exe1234.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	1172	WerFault.exe
Token: SeSystemtimePrivilege	1632	rundll32.exe
Token: SeSystemtimePrivilege	1632	rundll32.exe
Token: SeSystemtimePrivilege	1632	rundll32.exe
Token: SeSystemtimePrivilege	1632	rundll32.exe
Token: SeDebugPrivilege	1972	1234.exe
Token: SeDebugPrivilege	328	taskmgr.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

WerFault.exetaskmgr.exe

pid	process
1172	WerFault.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

taskmgr.exe

pid	process
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe
328	taskmgr.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

1234.execontrol.exe1234.execmd.execmd.exe

description	pid	process	target process
PID 368 wrote to memory of 1172	368	1234.exe	WerFault.exe
PID 368 wrote to memory of 1172	368	1234.exe	WerFault.exe
PID 368 wrote to memory of 1172	368	1234.exe	WerFault.exe
PID 368 wrote to memory of 1172	368	1234.exe	WerFault.exe
PID 1412 wrote to memory of 1632	1412	control.exe	rundll32.exe
PID 1412 wrote to memory of 1632	1412	control.exe	rundll32.exe
PID 1412 wrote to memory of 1632	1412	control.exe	rundll32.exe
PID 1972 wrote to memory of 1840	1972	1234.exe	cmd.exe
PID 1972 wrote to memory of 1840	1972	1234.exe	cmd.exe
PID 1972 wrote to memory of 1840	1972	1234.exe	cmd.exe
PID 1972 wrote to memory of 1840	1972	1234.exe	cmd.exe
PID 1840 wrote to memory of 1044	1840	cmd.exe	schtasks.exe
PID 1840 wrote to memory of 1044	1840	cmd.exe	schtasks.exe
PID 1840 wrote to memory of 1044	1840	cmd.exe	schtasks.exe
PID 1840 wrote to memory of 1044	1840	cmd.exe	schtasks.exe
PID 1972 wrote to memory of 1596	1972	1234.exe	cmd.exe
PID 1972 wrote to memory of 1596	1972	1234.exe	cmd.exe
PID 1972 wrote to memory of 1596	1972	1234.exe	cmd.exe
PID 1972 wrote to memory of 1596	1972	1234.exe	cmd.exe
PID 1596 wrote to memory of 848	1596	cmd.exe	timeout.exe
PID 1596 wrote to memory of 848	1596	cmd.exe	timeout.exe
PID 1596 wrote to memory of 848	1596	cmd.exe	timeout.exe
PID 1596 wrote to memory of 848	1596	cmd.exe	timeout.exe
PID 1596 wrote to memory of 1468	1596	cmd.exe	SystemLanguageDriverver2.31.exe
PID 1596 wrote to memory of 1468	1596	cmd.exe	SystemLanguageDriverver2.31.exe
PID 1596 wrote to memory of 1468	1596	cmd.exe	SystemLanguageDriverver2.31.exe
PID 1596 wrote to memory of 1468	1596	cmd.exe	SystemLanguageDriverver2.31.exe

C:\Users\Admin\AppData\Local\Temp\1234.exe
"C:\Users\Admin\AppData\Local\Temp\1234.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 536
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1172

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\system32\timedate.cpl",
1⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\timedate.cpl",
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:484

C:\Users\Admin\AppData\Local\Temp\1234.exe
"C:\Users\Admin\AppData\Local\Temp\1234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SystemLanguageDriverver2.31" /tr '"C:\Users\Admin\AppData\Local\Temp\System Language Driver ver 2.31\SystemLanguageDriverver2.31.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "SystemLanguageDriverver2.31" /tr '"C:\Users\Admin\AppData\Local\Temp\System Language Driver ver 2.31\SystemLanguageDriverver2.31.exe"'
3⤵
- Creates scheduled task(s)
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1ED6.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:848

C:\Users\Admin\AppData\Local\Temp\System Language Driver ver 2.31\SystemLanguageDriverver2.31.exe
"C:\Users\Admin\AppData\Local\Temp\System Language Driver ver 2.31\SystemLanguageDriverver2.31.exe"
3⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1468

C:\Users\Admin\AppData\Local\Temp\1234.exe
"C:\Users\Admin\AppData\Local\Temp\1234.exe"
1⤵
PID:1560

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Install Root Certificate

1

T1130

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System Language Driver ver 2.31\SystemLanguageDriverver2.31.exe
MD5
756e27b07ecf39d5dbd7bcaac4e9fdf0

SHA1
a5afec50715a70ff746bcef8574318edd5d019c9

SHA256
ee704b2132c2cdc7faf8ede44786d198f4f3a242df002722b7482563a6c0bff6

SHA512
b5c77d3733986965b3788909001569517a19ca0feffd12ed8315e75dde6bed52002186422dad350686a8411cc76bc502a287c6d95a6f03dee49d4747b428dbea

Download Submit
C:\Users\Admin\AppData\Local\Temp\System Language Driver ver 2.31\SystemLanguageDriverver2.31.exe
MD5
354f1aca2059ebdaee5026fa8e4b87c3

SHA1
709e842ba31af1807c1e54bb200f271ec6ad166b

SHA256
b406f3bd48de7bbbdf6c00d42a7a47d0e3cf3fd7c2619a31cf4e39cdf86623bf

SHA512
cdfacd5ab02b8e178dfc48a9ca4a9929fc9a9b951993d07621f3612f301c156aff0a4b3a26f0d5b71d6b4c9c35abe45cdea4ab58c9e2f67b7e3618b2a0b37076

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1ED6.tmp.bat
MD5
7c5e2437649bd4c5b8ce409f22de6d69

SHA1
6a04da996bcfab29164be763124ce878c26d9104

SHA256
23a769fa3308c70c1dcf81f79df8ecc6382464a7c3a538bd4489cd0ff44dd179

SHA512
9434084c96cb566079b69f8911c010999cefe2890c0ab4735a8503de21f1aa2768253f13709980b3228f9c8b4dd56e510a1d0e256f402bbf59dd63bb0417b180

Download Submit
\Users\Admin\AppData\Local\Temp\System Language Driver ver 2.31\SystemLanguageDriverver2.31.exe
MD5
f4c119000e31a37eac7befab194e3f75

SHA1
159afa5a09306687f1fe79f110e75c78894acd15

SHA256
83f5531ce9ba2c31ee64c15763e7622f08f5d18be8ae694d297fee464ec3d7b6

SHA512
bcb388665d38b53ce3041965b99cd0f8f062b444f20b013c8d073cc460ec7a5bd728769458a62ba7e1a9c3ab6794f0e981860967c76aa5e283ada588445521c2

Download Submit
memory/368-59-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/848-74-0x0000000000000000-mapping.dmp

Download
memory/1044-71-0x0000000000000000-mapping.dmp

Download
memory/1172-61-0x0000000000000000-mapping.dmp

Download
memory/1172-62-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/1412-63-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

Filesize
8KB

Download
memory/1468-81-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/1468-79-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1468-77-0x0000000000000000-mapping.dmp

Download
memory/1560-82-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1560-84-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/1596-72-0x0000000000000000-mapping.dmp

Download
memory/1632-64-0x0000000000000000-mapping.dmp

Download
memory/1840-70-0x0000000000000000-mapping.dmp

Download
memory/1972-69-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads