Analysis
- max time kernel
122s - max time network
137s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
22/10/2021, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
44a20c6259effbc4f8d19d3b9ad9e79e.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
44a20c6259effbc4f8d19d3b9ad9e79e.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target 44a20c6259effbc4f8d19d3b9ad9e79e.exe
- Size 444KB
- Sample211022-rfj54sbfh8
- SHA256 8df85de69eca57ba12d2044e751c655cef674fb84b9a78d0c3f48c7d71285eef
- MD5 44a20c6259effbc4f8d19d3b9ad9e79e
- SHA1 170ad5ae18a3080f27ca66bae3cb5eaf4125e4d1
- SHA512 996009c1ca9ef758f0529645962c83b6ca9f603edf7fc43d7dcb844cc3698e67b82629f705c592714f297def233cdef73ffa7a94342d542a25ab4bc6bc645c8b
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 6 IoCs
pid pid_target Process procid_target 4324 4276 WerFault.exe 68 4284 4276 WerFault.exe 68 780 4276 WerFault.exe 68 4580 4276 WerFault.exe 68 4556 4276 WerFault.exe 68 4440 4276 WerFault.exe 68 - Kills process with taskkill 1 IoCs
pid Process 3968 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4324 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 4284 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 780 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4556 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe 4440 WerFault.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 4324 WerFault.exe Token: SeBackupPrivilege 4324 WerFault.exe Token: SeDebugPrivilege 4324 WerFault.exe Token: SeDebugPrivilege 4284 WerFault.exe Token: SeDebugPrivilege 780 WerFault.exe Token: SeDebugPrivilege 4580 WerFault.exe Token: SeDebugPrivilege 4556 WerFault.exe Token: SeDebugPrivilege 4440 WerFault.exe Token: SeDebugPrivilege 3968 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4276 wrote to memory of 3216 4276 44a20c6259effbc4f8d19d3b9ad9e79e.exe 76 PID 4276 wrote to memory of 3216 4276 44a20c6259effbc4f8d19d3b9ad9e79e.exe 76 PID 4276 wrote to memory of 3216 4276 44a20c6259effbc4f8d19d3b9ad9e79e.exe 76 PID 3216 wrote to memory of 3968 3216 cmd.exe 78 PID 3216 wrote to memory of 3968 3216 cmd.exe 78 PID 3216 wrote to memory of 3968 3216 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\44a20c6259effbc4f8d19d3b9ad9e79e.exe"C:\Users\Admin\AppData\Local\Temp\44a20c6259effbc4f8d19d3b9ad9e79e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 7442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 8762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 8882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "44a20c6259effbc4f8d19d3b9ad9e79e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\44a20c6259effbc4f8d19d3b9ad9e79e.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "44a20c6259effbc4f8d19d3b9ad9e79e.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-