909aaea4a3072305c0bcaab9d7b9cab70990305541db276ab8d870e3fbc51a18

Analysis

Target

SHSPDO6BYDV7xlwsZDJxsLj9.exe
Size

317KB
MD5

145bf5658332302310a7fe40ed77783d
SHA1

5370ac46379b8db9d9fca84f21d411687109486f
SHA256

bddcd5eba3036a21b11e6d6d3cbe84daf562db27814adf7e32b5cc103d3c25d3
SHA512

d3d9a8231f256efee7ce7ba6841d78c598dc912e7e5d503a9a094e6303d0f9f165a60c5370f353076b1f592d7d9ee6765d0ba4863a1c4935bb47e2ffa4ffb776

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3696 created 3916 3696 WerFault.exe SHSPDO6BYDV7xlwsZDJxsLj9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 3696 created 3916	3696	WerFault.exe	SHSPDO6BYDV7xlwsZDJxsLj9.exe

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2872	3916	WerFault.exe	SHSPDO6BYDV7xlwsZDJxsLj9.exe
4012	3916	WerFault.exe	SHSPDO6BYDV7xlwsZDJxsLj9.exe
3612	3916	WerFault.exe	SHSPDO6BYDV7xlwsZDJxsLj9.exe
204	3916	WerFault.exe	SHSPDO6BYDV7xlwsZDJxsLj9.exe
1420	3916	WerFault.exe	SHSPDO6BYDV7xlwsZDJxsLj9.exe
3696	3916	WerFault.exe	SHSPDO6BYDV7xlwsZDJxsLj9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

C:\Users\Admin\AppData\Local\Temp\SHSPDO6BYDV7xlwsZDJxsLj9.exe
"C:\Users\Admin\AppData\Local\Temp\SHSPDO6BYDV7xlwsZDJxsLj9.exe"
1⤵
PID:3916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 676
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 804
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 772
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 776
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1052
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1072
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3696

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3916-114-0x0000000004100000-0x000000000412F000-memory.dmp

Filesize
188KB

Download
memory/3916-115-0x0000000000400000-0x00000000023BA000-memory.dmp

Filesize
31.7MB

Download