Analysis
- max time kernel
24s - max time network
123s - platform
windows10_x64 - resource
win10v20210408 - submitted
13/08/2021, 23:51
General
- Target ee04b4b9505f5b24778e84e0c0342027.exe
- Size 3.4MB
- Sample210813-ansyf4dqcs
- SHA256 7e4bc5c98691dd99d7c856dc26110113c15d72fb5b8a73db75a9c9b2bee021e2
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee04b4b9505f5b24778e84e0c0342027.exe"C:\Users\Admin\AppData\Local\Temp\ee04b4b9505f5b24778e84e0c0342027.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Svc_host.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Svc_host.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2876 -s 12923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2876-120-0x00000238E1E60000-0x00000238E1E61000-memory.dmp
memory/2876-123-0x00000238FD4B0000-0x00000238FD4B1000-memory.dmp
memory/2876-125-0x00000238E21A0000-0x00000238E21A1000-memory.dmp
memory/2876-124-0x00000238E3C00000-0x00000238E3C02000-memory.dmp
memory/2876-126-0x00000238E2260000-0x00000238E2261000-memory.dmp