Analysis

  • max time kernel
    154s
  • max time network
    156s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    10-11-2021 14:50

General

  • Target

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe

  • Size

    834KB

  • MD5

    2c25a0926e5228d2205b3b8c8ef4d7f4

  • SHA1

    5f8a9d364dc3d03a5b11fd5be0629d0fb5a8c409

  • SHA256

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6

  • SHA512

    cafe8fae74d414015118b838b5e4b30183733d5e833c5db84a56bd2d5cf728cad08d2bbefbeadc86b15b7dbf6dc25fcabdffa8ff4fb346dc0f66376087a28468

Score
10/10

Malware Config

Signatures 9

  • Suspicious use of NtCreateProcessExOtherParentProcess ⋅ 1 IoCs
  • Loads dropped DLL ⋅ 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 1 IoCs
  • Checks processor information in registry ⋅ 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry ⋅ 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 5 IoCs

Processes 4

  • C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
    "C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe"
    Suspicious use of WriteProcessMemory
    PID:3364
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" sqlite.dll,global
      Loads dropped DLL
      PID:2420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 456
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:3140
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2420 -ip 2420
    Suspicious use of NtCreateProcessExOtherParentProcess
    Suspicious use of WriteProcessMemory
    PID:3100

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                          MD5

                          bbd4ce7a3b397979f6725781367e2671

                          SHA1

                          1627f36916b4a3e2384a3aa2b0af35ba9e785093

                          SHA256

                          c13e0dd5f82062a4659f6fa989b00a2d109644156675aa63e7670288723a9fe4

                          SHA512

                          b0a5708673f3077eaad552ea664f16b569b653be55865221506b537b41c77ec9b5610d3f67b996e7f2da0bd08da274dc01c9e7db2ce1ed706c18812093d76b65

                        • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                          MD5

                          d2c3e38d64273ea56d503bb3fb2a8b5d

                          SHA1

                          177da7d99381bbc83ede6b50357f53944240d862

                          SHA256

                          25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                          SHA512

                          2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                        • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                          MD5

                          d2c3e38d64273ea56d503bb3fb2a8b5d

                          SHA1

                          177da7d99381bbc83ede6b50357f53944240d862

                          SHA256

                          25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                          SHA512

                          2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                        • memory/2420-148-0x0000000000000000-mapping.dmp
                        • memory/3364-146-0x0000000002B30000-0x0000000002B31000-memory.dmp
                        • memory/3364-147-0x0000000002B30000-0x0000000002B31000-memory.dmp