Analysis
- max time kernel
22s - max time network
136s - platform
windows10_x64 - resource
win10-en - submitted
06/09/2021, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
83e5a7cb9e555e32ff4e6167a6146a62.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
83e5a7cb9e555e32ff4e6167a6146a62.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target 83e5a7cb9e555e32ff4e6167a6146a62.exe
- Size 350KB
- Sample210906-e3nqladbal
- SHA256 cd8076d813038ef3a2a527e4d1a126da089b11eb61da11636cb67fc110e42baf
- MD5 83e5a7cb9e555e32ff4e6167a6146a62
- SHA1 cddee7e01e84734b97c1ff50f7d26cdfb4068dce
- SHA512 4f31a61e2223264d83270c36bba34e31d4a0a588f6e7c093b5774a2ce03ba2247c2781c250a96cc123d23328131909133a60d78259bc676f38ccd49fcc8d170f
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 6 IoCs
pid pid_target Process procid_target 4112 4472 WerFault.exe 68 1876 4472 WerFault.exe 68 4244 4472 WerFault.exe 68 4196 4472 WerFault.exe 68 4312 4472 WerFault.exe 68 4288 4472 WerFault.exe 68 - Kills process with taskkill 1 IoCs
pid Process 4248 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 4112 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4244 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4196 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 4112 WerFault.exe Token: SeBackupPrivilege 4112 WerFault.exe Token: SeDebugPrivilege 4112 WerFault.exe Token: SeDebugPrivilege 1876 WerFault.exe Token: SeDebugPrivilege 4244 WerFault.exe Token: SeDebugPrivilege 4196 WerFault.exe Token: SeDebugPrivilege 4312 WerFault.exe Token: SeDebugPrivilege 4288 WerFault.exe Token: SeDebugPrivilege 4248 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4472 wrote to memory of 4332 4472 83e5a7cb9e555e32ff4e6167a6146a62.exe 86 PID 4472 wrote to memory of 4332 4472 83e5a7cb9e555e32ff4e6167a6146a62.exe 86 PID 4472 wrote to memory of 4332 4472 83e5a7cb9e555e32ff4e6167a6146a62.exe 86 PID 4332 wrote to memory of 4248 4332 cmd.exe 88 PID 4332 wrote to memory of 4248 4332 cmd.exe 88 PID 4332 wrote to memory of 4248 4332 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\83e5a7cb9e555e32ff4e6167a6146a62.exe"C:\Users\Admin\AppData\Local\Temp\83e5a7cb9e555e32ff4e6167a6146a62.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 7482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 8642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 8762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 9322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 9002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "83e5a7cb9e555e32ff4e6167a6146a62.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\83e5a7cb9e555e32ff4e6167a6146a62.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "83e5a7cb9e555e32ff4e6167a6146a62.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-