e431da31eb509224ab13458b7f50a92f3a2f41cf01c8014f69f0eaf9339ab9e4

General

Target
0WCLsG8DXRR4L6nx44K2.exe
Size 1.2MB
Sample210505-sbjgzerjge
SHA256 e431da31eb509224ab13458b7f50a92f3a2f41cf01c8014f69f0eaf9339ab9e4
MD5 57a3c027ae6556b13744bc6096e1825a
SHA1 3e721625a33b3d4baef420c1c7397e338a57b23f
SHA512 b657263b5e48edc9cd46c606e4e0880581a2c901d5b1db88569620ca74d2708d9d9b3c34a5b3cd700395ec92116692971caefe48c6623c3ed22b81ba35df0804
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 660 set thread context of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1512	660	WerFault.exe	67

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
436	timeout.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
660	0WCLsG8DXRR4L6nx44K2.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	0WCLsG8DXRR4L6nx44K2.exe
Token: SeRestorePrivilege	1512	WerFault.exe
Token: SeBackupPrivilege	1512	WerFault.exe
Token: SeDebugPrivilege	1512	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 432	660	0WCLsG8DXRR4L6nx44K2.exe	75
PID 660 wrote to memory of 432	660	0WCLsG8DXRR4L6nx44K2.exe	75
PID 660 wrote to memory of 432	660	0WCLsG8DXRR4L6nx44K2.exe	75
PID 432 wrote to memory of 436	432	cmd.exe	77
PID 432 wrote to memory of 436	432	cmd.exe	77
PID 432 wrote to memory of 436	432	cmd.exe	77
PID 660 wrote to memory of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78
PID 660 wrote to memory of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78
PID 660 wrote to memory of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78
PID 660 wrote to memory of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78
PID 660 wrote to memory of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78
PID 660 wrote to memory of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78
PID 660 wrote to memory of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78
PID 660 wrote to memory of 220	660	0WCLsG8DXRR4L6nx44K2.exe	78

C:\Users\Admin\AppData\Local\Temp\0WCLsG8DXRR4L6nx44K2.exe
"C:\Users\Admin\AppData\Local\Temp\0WCLsG8DXRR4L6nx44K2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:436
- C:\Users\Admin\AppData\Local\Temp\0WCLsG8DXRR4L6nx44K2.exe
  "C:\Users\Admin\AppData\Local\Temp\0WCLsG8DXRR4L6nx44K2.exe"
  2⤵
  PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 1496
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-122-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/220-126-0x00000000030E0000-0x00000000030F7000-memory.dmp

Download

memory/220-127-0x0000000003110000-0x0000000003111000-memory.dmp

Download

memory/220-128-0x0000000005E50000-0x0000000005E51000-memory.dmp

Download

memory/660-114-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/660-116-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download

memory/660-117-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/660-118-0x0000000002DB0000-0x0000000002DDC000-memory.dmp

Download

memory/660-121-0x0000000006470000-0x0000000006471000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads