9ee3f359c016cb3cf41ad7558cb18e92e224658b75e6b082b103ba293298a79f

Analysis

Target
9443fe1d92c02a1ae088f8683f8fbd21.exe
Size 17KB
Sample210927-kceynagbd2
SHA256 9ee3f359c016cb3cf41ad7558cb18e92e224658b75e6b082b103ba293298a79f
MD5 9443fe1d92c02a1ae088f8683f8fbd21
SHA1 f50d85a60e6bc2dbf81b44bb8dc7d6179d3a4ece
SHA512 aa77d24581d56d1770669618e77fe8affd3c106c9bbfb588f1884124b6f79cbcc06cba677b31a800c1f7c794bccbe8abaf06f7648a24b594e4e0d60832bed51e
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	992	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

C:\Users\Admin\AppData\Local\Temp\9443fe1d92c02a1ae088f8683f8fbd21.exe
"C:\Users\Admin\AppData\Local\Temp\9443fe1d92c02a1ae088f8683f8fbd21.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1996
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1476

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmp

Download

memory/992-116-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download