Analysis
- max time kernel
101s - max time network
103s - platform
windows10_x64 - resource
win10v20210408 - submitted
20/09/2021, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
84988f8e8d923673a26c009b55825bf6.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
84988f8e8d923673a26c009b55825bf6.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 84988f8e8d923673a26c009b55825bf6.exe
- Size 314KB
- Sample210920-t65wlshcfp
- SHA256 2fdb6f86925379ff52bbb5a5bb7ab5b53dc40d828d4a5f52c0189050b1dcb847
- MD5 84988f8e8d923673a26c009b55825bf6
- SHA1 7432dee3986c34bee9a4ee75f54adfb6437ce57b
- SHA512 7fd25c44fb52ae0b5649d529038aa9e9003b993750d3c615a34e339caa4797d4aa7ddc0d651ec047558e0995d6abb9ef905f56e62d6ccbbb283c26db4c0435ce
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 7 IoCs
pid pid_target Process procid_target 680 764 WerFault.exe 67 1168 764 WerFault.exe 67 1288 764 WerFault.exe 67 1452 764 WerFault.exe 67 1636 764 WerFault.exe 67 1796 764 WerFault.exe 67 1376 764 WerFault.exe 67 - Kills process with taskkill 1 IoCs
pid Process 2592 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 680 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1288 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1452 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe 1636 WerFault.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeRestorePrivilege 680 WerFault.exe Token: SeBackupPrivilege 680 WerFault.exe Token: SeDebugPrivilege 680 WerFault.exe Token: SeDebugPrivilege 1168 WerFault.exe Token: SeDebugPrivilege 1288 WerFault.exe Token: SeDebugPrivilege 1452 WerFault.exe Token: SeDebugPrivilege 1636 WerFault.exe Token: SeDebugPrivilege 1796 WerFault.exe Token: SeDebugPrivilege 1376 WerFault.exe Token: SeDebugPrivilege 2592 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 764 wrote to memory of 2096 764 84988f8e8d923673a26c009b55825bf6.exe 76 PID 764 wrote to memory of 2096 764 84988f8e8d923673a26c009b55825bf6.exe 76 PID 764 wrote to memory of 2096 764 84988f8e8d923673a26c009b55825bf6.exe 76 PID 2096 wrote to memory of 2592 2096 cmd.exe 78 PID 2096 wrote to memory of 2592 2096 cmd.exe 78 PID 2096 wrote to memory of 2592 2096 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\84988f8e8d923673a26c009b55825bf6.exe"C:\Users\Admin\AppData\Local\Temp\84988f8e8d923673a26c009b55825bf6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 6602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 6722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 8122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 8282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 8882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 11522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 11642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "84988f8e8d923673a26c009b55825bf6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\84988f8e8d923673a26c009b55825bf6.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "84988f8e8d923673a26c009b55825bf6.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-