Analysis
- max time kernel
14s - max time network
114s - platform
windows10_x64 - resource
win10v20210410 - submitted
03/08/2021, 14:57
General
- Target e6750738c8e3adfef9253fd4d3371314.exe
- Size 3.5MB
- Sample210803-psqdae3brx
- SHA256 291d61c17a1a558d179c8c8993e747e1c5aadc0c5d9bdcbb0bf4723a5eb2d64a
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6750738c8e3adfef9253fd4d3371314.exe"C:\Users\Admin\AppData\Local\Temp\e6750738c8e3adfef9253fd4d3371314.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Svc_host.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Svc_host.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2740 -s 13083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2740-120-0x0000017FA8A00000-0x0000017FA8A01000-memory.dmp
memory/2740-122-0x0000017FA8D40000-0x0000017FA8D41000-memory.dmp
memory/2740-124-0x0000017FC30E0000-0x0000017FC30E1000-memory.dmp
memory/2740-125-0x0000017FA8DE0000-0x0000017FA8DE1000-memory.dmp
memory/2740-126-0x0000017FA8D90000-0x0000017FA8D92000-memory.dmp