fe5254468c8a6c7a17dc11f3e85b00db1b5b2b3c26919bdefb8d917ce35cb4d5

Analysis

max time kernel
18s
max time network
126s
platform
windows10_x64
resource
win10v20210408
submitted
13/08/2021, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
F5881584C73A9416A65CBC5CA849F5BB.exe
Size 406KB
Sample210813-eqvytejtcj
SHA256 fe5254468c8a6c7a17dc11f3e85b00db1b5b2b3c26919bdefb8d917ce35cb4d5
MD5 f5881584c73a9416a65cbc5ca849f5bb
SHA1 e50f322a92332202299fbd9b38e0ccd793058133
SHA512 4e608be3de18065f89ae0144ccb46378a26cf15e61f739a338bf5f544b1060a8c800549256d17bb741c140dd68b0fc0c8bbc1c392b4824524dbfb7409bc2b168
MD5 SHA1 SHA512

Score

10^/10

suricata

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2392 created 636	2392	WerFault.exe	67

suricata: ET MALWARE GCleaner Downloader Activity M1
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata
Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
3180	636	WerFault.exe	67
3580	636	WerFault.exe	67
2736	636	WerFault.exe	67
200	636	WerFault.exe	67
820	636	WerFault.exe	67
3612	636	WerFault.exe	67
1928	636	WerFault.exe	67
3812	636	WerFault.exe	67
2272	636	WerFault.exe	67
1816	636	WerFault.exe	67
2392	636	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
3580	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
200	WerFault.exe
820	WerFault.exe
820	WerFault.exe
820	WerFault.exe
820	WerFault.exe
820	WerFault.exe
820	WerFault.exe
820	WerFault.exe
820	WerFault.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	3180	WerFault.exe
Token: SeBackupPrivilege	3180	WerFault.exe
Token: SeDebugPrivilege	3180	WerFault.exe
Token: SeDebugPrivilege	3580	WerFault.exe
Token: SeDebugPrivilege	2736	WerFault.exe
Token: SeDebugPrivilege	200	WerFault.exe
Token: SeDebugPrivilege	820	WerFault.exe
Token: SeDebugPrivilege	3612	WerFault.exe
Token: SeDebugPrivilege	1928	WerFault.exe
Token: SeDebugPrivilege	3812	WerFault.exe
Token: SeDebugPrivilege	2272	WerFault.exe
Token: SeDebugPrivilege	1816	WerFault.exe
Token: SeDebugPrivilege	2392	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\F5881584C73A9416A65CBC5CA849F5BB.exe
"C:\Users\Admin\AppData\Local\Temp\F5881584C73A9416A65CBC5CA849F5BB.exe"
1⤵
PID:636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 664
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 680
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 812
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 792
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 872
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 884
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 1324
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 1336
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 1480
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 1520
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 1512
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-114-0x00000000001C0000-0x00000000001EE000-memory.dmp

Download

memory/636-115-0x0000000000400000-0x0000000003302000-memory.dmp

Download