Analysis
- max time kernel
19s - max time network
120s - platform
windows10_x64 - resource
win10v20210408 - submitted
28/08/2021, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
78563a66f06fd8e6132d1ee4c8a5ab2a.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
78563a66f06fd8e6132d1ee4c8a5ab2a.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 78563a66f06fd8e6132d1ee4c8a5ab2a.exe
- Size 221KB
- Sample210828-vjl9epf4js
- SHA256 6afa5829ac5dfbb7098a32cef1dca23e5bbdf9a1bc0805670451eeed534c5636
- MD5 78563a66f06fd8e6132d1ee4c8a5ab2a
- SHA1 a2c487251cac61520c3156b46b80460b95a00859
- SHA512 3e37db4cac7018281e220305351c799ca9e488eba98adeae93e140623f1dd60f85c9d8a0cd750034357f8eefad15283bb5c432bda7a76684dd5ac06065f3883c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 424 created 996 424 WerFault.exe 67 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 7 IoCs
pid pid_target Process procid_target 3856 996 WerFault.exe 67 1332 996 WerFault.exe 67 3180 996 WerFault.exe 67 2976 996 WerFault.exe 67 2128 996 WerFault.exe 67 1196 996 WerFault.exe 67 424 996 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2976 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 3856 WerFault.exe Token: SeBackupPrivilege 3856 WerFault.exe Token: SeDebugPrivilege 3856 WerFault.exe Token: SeDebugPrivilege 1332 WerFault.exe Token: SeDebugPrivilege 3180 WerFault.exe Token: SeDebugPrivilege 2976 WerFault.exe Token: SeDebugPrivilege 2128 WerFault.exe Token: SeDebugPrivilege 1196 WerFault.exe Token: SeDebugPrivilege 424 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78563a66f06fd8e6132d1ee4c8a5ab2a.exe"C:\Users\Admin\AppData\Local\Temp\78563a66f06fd8e6132d1ee4c8a5ab2a.exe"1⤵PID:996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 6682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 6802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 7762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 8122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 11202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 11122⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:424
-