Behavioral Report

Target

e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Size

834KB
MD5

2c25a0926e5228d2205b3b8c8ef4d7f4
SHA1

5f8a9d364dc3d03a5b11fd5be0629d0fb5a8c409
SHA256

e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6
SHA512

cafe8fae74d414015118b838b5e4b30183733d5e833c5db84a56bd2d5cf728cad08d2bbefbeadc86b15b7dbf6dc25fcabdffa8ff4fb346dc0f66376087a28468

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess ⋅ 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3100 created 2420 3100 WerFault.exe rundll32.exe
Loads dropped DLL ⋅ 1 IoCs

Processes:

rundll32.exe

pid process

2420 rundll32.exe
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery
Program crash ⋅ 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3140 2420 WerFault.exe rundll32.exe

description	pid	process	target process
PID 3100 created 2420	3100	WerFault.exe	rundll32.exe

pid	process
2420	rundll32.exe

pid	pid_target	process	target process
3140	2420	WerFault.exe	rundll32.exe

Checks processor information in registry ⋅ 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry ⋅ 2 TTPs 2 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs

Processes:

WerFault.exe

pid process

3140 WerFault.exe
3140 WerFault.exe
Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3140 WerFault.exe
Token: SeBackupPrivilege 3140 WerFault.exe

pid	process
3140	WerFault.exe
3140	WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3140	WerFault.exe
Token: SeBackupPrivilege	3140	WerFault.exe

Suspicious use of WriteProcessMemory ⋅ 5 IoCs

Processes:

e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exeWerFault.exe

description	pid	process	target process
PID 3364 wrote to memory of 2420	3364	e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe	rundll32.exe
PID 3364 wrote to memory of 2420	3364	e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe	rundll32.exe
PID 3364 wrote to memory of 2420	3364	e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe	rundll32.exe
PID 3100 wrote to memory of 2420	3100	WerFault.exe	rundll32.exe
PID 3100 wrote to memory of 2420	3100	WerFault.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe

"C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe"

Suspicious use of WriteProcessMemory

PID:3364

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" sqlite.dll,global

Loads dropped DLL

PID:2420

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 456

Program crash
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:3140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2420 -ip 2420

Suspicious use of NtCreateProcessExOtherParentProcess
Suspicious use of WriteProcessMemory

PID:3100

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Temp\sqlite.dat
MD5
bbd4ce7a3b397979f6725781367e2671

SHA1
1627f36916b4a3e2384a3aa2b0af35ba9e785093

SHA256
c13e0dd5f82062a4659f6fa989b00a2d109644156675aa63e7670288723a9fe4

SHA512
b0a5708673f3077eaad552ea664f16b569b653be55865221506b537b41c77ec9b5610d3f67b996e7f2da0bd08da274dc01c9e7db2ce1ed706c18812093d76b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
d2c3e38d64273ea56d503bb3fb2a8b5d

SHA1
177da7d99381bbc83ede6b50357f53944240d862

SHA256
25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

SHA512
2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
d2c3e38d64273ea56d503bb3fb2a8b5d

SHA1
177da7d99381bbc83ede6b50357f53944240d862

SHA256
25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

SHA512
2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

Download Submit
memory/2420-148-0x0000000000000000-mapping.dmp

Download
memory/3364-146-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/3364-147-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download