Analysis
- max time kernel
84s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
17/09/2021, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
0817afc9180089bbeb586f449ded2adf.exe
Resource
win7-en-20210916
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0817afc9180089bbeb586f449ded2adf.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 0817afc9180089bbeb586f449ded2adf.exe
- Size 317KB
- Sample210917-e2jegshefr
- SHA256 6ef9af06422a0b2cc70ae23b0439edf9b8e950c91596087cd537d6435c9c85e4
- MD5 0817afc9180089bbeb586f449ded2adf
- SHA1 e376032e8b1d79a7b1354dfe5fa482b585efc96f
- SHA512 9174d207f0666b8149c730fdc9951814ca93be53a073eb893f5ee928c8b31d9b9fef3d7e241936cce23fb379d721baa50283508fa33dbeddbef4055381b95480
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 6 IoCs
pid pid_target Process procid_target 3936 4060 WerFault.exe 67 3552 4060 WerFault.exe 67 3920 4060 WerFault.exe 67 3560 4060 WerFault.exe 67 996 4060 WerFault.exe 67 3556 4060 WerFault.exe 67 - Kills process with taskkill 1 IoCs
pid Process 2244 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3552 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe 996 WerFault.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 3936 WerFault.exe Token: SeBackupPrivilege 3936 WerFault.exe Token: SeDebugPrivilege 3936 WerFault.exe Token: SeDebugPrivilege 3552 WerFault.exe Token: SeDebugPrivilege 3920 WerFault.exe Token: SeDebugPrivilege 3560 WerFault.exe Token: SeDebugPrivilege 996 WerFault.exe Token: SeDebugPrivilege 3556 WerFault.exe Token: SeDebugPrivilege 2244 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4060 wrote to memory of 3156 4060 0817afc9180089bbeb586f449ded2adf.exe 75 PID 4060 wrote to memory of 3156 4060 0817afc9180089bbeb586f449ded2adf.exe 75 PID 4060 wrote to memory of 3156 4060 0817afc9180089bbeb586f449ded2adf.exe 75 PID 3156 wrote to memory of 2244 3156 cmd.exe 77 PID 3156 wrote to memory of 2244 3156 cmd.exe 77 PID 3156 wrote to memory of 2244 3156 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\0817afc9180089bbeb586f449ded2adf.exe"C:\Users\Admin\AppData\Local\Temp\0817afc9180089bbeb586f449ded2adf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 7962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 8402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 8642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0817afc9180089bbeb586f449ded2adf.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0817afc9180089bbeb586f449ded2adf.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0817afc9180089bbeb586f449ded2adf.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-