Overview
overview
10Static
static
10Mr4X5srRQR...AN.exe
windows10_x64
10OEmxRS9Uai...jI.exe
windows10_x64
10OvVYhhgvd6...oB.exe
windows10_x64
9QKvpJeDIaP...YY.exe
windows10_x64
9QwnNK2SHck...xe.xml
windows10_x64
1QxZsdXOO8X...jN.exe
windows10_x64
10QzUu4XgUxQ...C3.exe
windows10_x64
10SHSPDO6BYD...j9.exe
windows10_x64
10SqCuVl85T1...Di.exe
windows10_x64
10T8Ulrjj8F6..._x.exe
windows10_x64
10Trj0QcTNVE...S9.exe
windows10_x64
10Uwc7l02Hzj...tU.exe
windows10_x64
6VoTrXaqIJ3...LW.exe
windows10_x64
10Wp77te7Dqj...Hr.exe
windows10_x64
9XOCYAkm_Nn...Q3.exe
windows10_x64
9Xd_XnNqsZT...Ai.exe
windows10_x64
10Xr9ca9oQNQ...Z9.exe
windows10_x64
9XukfUfK8HA...FI.exe
windows10_x64
8YPTXDeqMC1...ns.exe
windows10_x64
8ma_5nZD3yo...xT.exe
windows10_x64
10pnDF_dk604...fi.exe
windows10_x64
10q_TzaanAkp...91.exe
windows10_x64
9rgVakr0Eru...xw.exe
windows10_x64
10t1fkwFYUEZ...r4.exe
windows10_x64
10tC6gdsFTgl...3x.exe
windows10_x64
10tGeiUalbSc...xe.xml
windows10_x64
1uMWmES83od...kJ.exe
windows10_x64
10v5n1HuUxta...Iu.exe
windows10_x64
10wTzxLyAQL7...bA.exe
windows10_x64
6xiGD01oEkh...VJ.exe
windows10_x64
10yBqNUgvOW6...Fb.exe
windows10_x64
10Analysis
-
max time kernel
307s -
max time network
316s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-08-2021 20:55
Behavioral task
behavioral1
Sample
Mr4X5srRQR20TfuVZShfsrAN.exe
Resource
win10v20210410
Behavioral task
behavioral2
Sample
OEmxRS9UaiMPqIKXPz6Ef8jI.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
OvVYhhgvd6ZhUony5cRMqVoB.exe
Resource
win10v20210410
Behavioral task
behavioral4
Sample
QKvpJeDIaPtXDcwKwH_WmAYY.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
QwnNK2SHckcc_GsoTwi8hDi5.exe.xml
Resource
win10v20210410
Behavioral task
behavioral6
Sample
QxZsdXOO8Xn2bW7iW8ff3gjN.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
QzUu4XgUxQuvhFNx7Nf5D6C3.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
SHSPDO6BYDV7xlwsZDJxsLj9.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
SqCuVl85T1P8OuH3gpVMKnDi.exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
T8Ulrjj8F65YXJ2qZEm11v_x.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Trj0QcTNVE3l8SBp_3LNLFS9.exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
Uwc7l02HzjEVLDdBFF3ZKItU.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
VoTrXaqIJ3vc2GnUIU6Wi5LW.exe
Resource
win10v20210408
Behavioral task
behavioral14
Sample
Wp77te7DqjxTjTIGMDSB0RHr.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
XOCYAkm_NnnfPmgVDNgu9MQ3.exe
Resource
win10v20210410
Behavioral task
behavioral16
Sample
Xd_XnNqsZTJJf8dCq4s_mlAi.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Xr9ca9oQNQWbUwEgChRmX6Z9.exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
XukfUfK8HAbjc5wMknHwOhFI.exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
YPTXDeqMC118ip3zHbyxwlns.exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
ma_5nZD3yos0uV8jzHnJSVxT.exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
pnDF_dk604_fxVsUaLPL1Vfi.exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
q_TzaanAkp60Doa2Vt025l91.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
rgVakr0EruC2FtauFmrgXkxw.exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
t1fkwFYUEZVXvf_7oFFpVnr4.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
tC6gdsFTgl9CBMrK_2QhZX3x.exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
tGeiUalbScQ8sPK2KKmKZNga.exe.xml
Resource
win10v20210410
Behavioral task
behavioral27
Sample
uMWmES83oduRUCtOU5jzfQkJ.exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
v5n1HuUxtaYNHT7sRlXCCwIu.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
wTzxLyAQL7H5FI0GIaor5FbA.exe
Resource
win10v20210410
Behavioral task
behavioral30
Sample
xiGD01oEkhh5s50F0Mw8lPVJ.exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
yBqNUgvOW6iDky2dKdBCi5Fb.exe
Resource
win10v20210410
General
-
Target
VoTrXaqIJ3vc2GnUIU6Wi5LW.exe
-
Size
321KB
-
MD5
94c78c311f499024a9f97cfdbb073623
-
SHA1
50e91d3eaa06d2183bf8c6c411947304421c5626
-
SHA256
6aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e
-
SHA512
29b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2136 created 1400 2136 WerFault.exe VoTrXaqIJ3vc2GnUIU6Wi5LW.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3296 1400 WerFault.exe VoTrXaqIJ3vc2GnUIU6Wi5LW.exe 2312 1400 WerFault.exe VoTrXaqIJ3vc2GnUIU6Wi5LW.exe 604 1400 WerFault.exe VoTrXaqIJ3vc2GnUIU6Wi5LW.exe 1500 1400 WerFault.exe VoTrXaqIJ3vc2GnUIU6Wi5LW.exe 2208 1400 WerFault.exe VoTrXaqIJ3vc2GnUIU6Wi5LW.exe 2288 1400 WerFault.exe VoTrXaqIJ3vc2GnUIU6Wi5LW.exe 2136 1400 WerFault.exe VoTrXaqIJ3vc2GnUIU6Wi5LW.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 604 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3296 WerFault.exe Token: SeBackupPrivilege 3296 WerFault.exe Token: SeDebugPrivilege 3296 WerFault.exe Token: SeDebugPrivilege 2312 WerFault.exe Token: SeDebugPrivilege 604 WerFault.exe Token: SeDebugPrivilege 1500 WerFault.exe Token: SeDebugPrivilege 2208 WerFault.exe Token: SeDebugPrivilege 2288 WerFault.exe Token: SeDebugPrivilege 2136 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoTrXaqIJ3vc2GnUIU6Wi5LW.exe"C:\Users\Admin\AppData\Local\Temp\VoTrXaqIJ3vc2GnUIU6Wi5LW.exe"1⤵PID:1400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 6642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 7122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 8242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 6962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 8722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 11082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 11202⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2136