Analysis
- max time kernel
27s - max time network
127s - platform
windows10_x64 - resource
win10v20210410 - submitted
13/08/2021, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
FE3EC61798741F90F745A0F508F78C33.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FE3EC61798741F90F745A0F508F78C33.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target FE3EC61798741F90F745A0F508F78C33.exe
- Size 11.2MB
- Sample210813-ltd41ghjsn
- SHA256 13e353b5aaf0a49286d0148954759cf4eb844087f28bf0be58f9fe0f8c9df947
- MD5 fe3ec61798741f90f745a0f508f78c33
- SHA1 a61540c961cbc8cc90715c610ec7e957d4153757
- SHA512 78fee25e34482064bdcbcdb1681c4156d6ecf5db1ede0273cbe8b8e887bd30a30c1fc9f4fc8bd4d7921321386d8728ddc4dfdd0ab44b1c76ed3a490b23d2e9ee
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5060 Vector Magic.exe 3888 Vector Magic.exe - Loads dropped DLL 2 IoCs
pid Process 5060 Vector Magic.exe 3888 Vector Magic.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 10 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic 1.15\Registry.rw.tvr Vector Magic.exe File opened for modification C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic 1.15\Registry.rw.tvr.transact Vector Magic.exe File opened for modification C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic 1.15\Registry.tlog Vector Magic.exe File created C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic 1.15\DummyTLS\-5064.5060.tmp Vector Magic.exe File opened for modification C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic.exe FE3EC61798741F90F745A0F508F78C33.exe File opened for modification C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Uninstall.exe FE3EC61798741F90F745A0F508F78C33.exe File created C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Uninstall.ini FE3EC61798741F90F745A0F508F78C33.exe File created C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic 1.15\Registry.rw.tvr.lck.RJMQBVDN.ffffffff.13c8 Vector Magic.exe File created C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic 1.15\Registry.rw.tvr.transact Vector Magic.exe File opened for modification C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic 1.15\Registry.tlog.cache Vector Magic.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4036 3888 WerFault.exe 78 - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000100000001ab8d-115.dat nsis_installer_2 behavioral2/files/0x000100000001ab8d-116.dat nsis_installer_2 behavioral2/files/0x000100000001ab8d-118.dat nsis_installer_2 behavioral2/files/0x000100000001ab8d-120.dat nsis_installer_2 - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe 4036 WerFault.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 5060 Vector Magic.exe 5060 Vector Magic.exe 5060 Vector Magic.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 4036 WerFault.exe Token: SeBackupPrivilege 4036 WerFault.exe Token: SeDebugPrivilege 4036 WerFault.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4452 wrote to memory of 5060 4452 FE3EC61798741F90F745A0F508F78C33.exe 76 PID 4452 wrote to memory of 5060 4452 FE3EC61798741F90F745A0F508F78C33.exe 76 PID 4452 wrote to memory of 5060 4452 FE3EC61798741F90F745A0F508F78C33.exe 76 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78 PID 5060 wrote to memory of 3888 5060 Vector Magic.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\FE3EC61798741F90F745A0F508F78C33.exe"C:\Users\Admin\AppData\Local\Temp\FE3EC61798741F90F745A0F508F78C33.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic.exe"C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic.exe"C:\Program Files (x86)\Vector Magic\vmde.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 4804⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
-