Analysis

  • max time kernel
    99s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14-09-2021 06:37

General

  • Target

    06208e61333652d3aec0ea22dfe9e0f0bb798152e29b8992fc7f82d96a5e1e7d.exe

  • Size

    514KB

  • MD5

    63432a8934949a6c8a0bac35a456187c

  • SHA1

    32af0c79573747414a58fe518d70373b97b725e7

  • SHA256

    06208e61333652d3aec0ea22dfe9e0f0bb798152e29b8992fc7f82d96a5e1e7d

  • SHA512

    d1f18d2703d6c8baff413711eea23b5b091b681e053b5c44f3e62f7e8b79566108a6f1b49c7c90a48ffecf3e0ced314cb13e80954f642c969a28d315136a1725

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06208e61333652d3aec0ea22dfe9e0f0bb798152e29b8992fc7f82d96a5e1e7d.exe
    "C:\Users\Admin\AppData\Local\Temp\06208e61333652d3aec0ea22dfe9e0f0bb798152e29b8992fc7f82d96a5e1e7d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:568
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 532
          3⤵
          • Program crash
          PID:1296
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 524
          3⤵
          • Program crash
          PID:1620
      • C:\Windows\SysWOW64\LaunchWinApp.exe
        C:\Windows\system32\LaunchWinApp.exe
        2⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 800
          3⤵
          • Program crash
          PID:1472

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    2
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/356-115-0x0000000000000000-mapping.dmp
    • memory/356-117-0x0000000010000000-0x0000000010082000-memory.dmp
      Filesize

      520KB

    • memory/900-114-0x0000000000000000-mapping.dmp
    • memory/900-116-0x0000000010000000-0x0000000010082000-memory.dmp
      Filesize

      520KB