Analysis
- max time kernel
88s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/10/2021, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
4e21ce85927c1ae64ef0011e421eedd2.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4e21ce85927c1ae64ef0011e421eedd2.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 4e21ce85927c1ae64ef0011e421eedd2.exe
- Size 308KB
- Sample211002-l6sbhsecel
- SHA256 d4bcfc7eac31ab3310de4fe8feb66dc6e1d9555493722b50c6fab5d03c4f290d
- MD5 4e21ce85927c1ae64ef0011e421eedd2
- SHA1 31c2953321aafa2df064b92538f0914c98d77408
- SHA512 e4858fcd86b70a9486a9361630f0d9f2565c0ff9ea39c487424aa8340f643028e592c755072e5fa4d7a42ba5aa29c15a97393ff7b840fefc2be2cd4e23d475fb
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4856 created 4648 4856 WerFault.exe 67 - suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 6 IoCs
pid pid_target Process procid_target 4716 4648 WerFault.exe 67 4752 4648 WerFault.exe 67 4780 4648 WerFault.exe 67 4804 4648 WerFault.exe 67 4836 4648 WerFault.exe 67 4856 4648 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4716 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4804 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe 4836 WerFault.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 4716 WerFault.exe Token: SeBackupPrivilege 4716 WerFault.exe Token: SeDebugPrivilege 4716 WerFault.exe Token: SeDebugPrivilege 4752 WerFault.exe Token: SeDebugPrivilege 4780 WerFault.exe Token: SeDebugPrivilege 4804 WerFault.exe Token: SeDebugPrivilege 4836 WerFault.exe Token: SeDebugPrivilege 4856 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e21ce85927c1ae64ef0011e421eedd2.exe"C:\Users\Admin\AppData\Local\Temp\4e21ce85927c1ae64ef0011e421eedd2.exe"1⤵PID:4648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 6642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 7722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 7842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 8122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 10602⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4856
-