64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

Resubmissions

10-11-2021 14:50

211110-r7nbvaeddr 10

08-11-2021 16:12

211108-tnmmbahgaj 10

08-11-2021 15:26

211108-svdsbaccf6 10

08-11-2021 14:48

211108-r6lfvshdfn 10

Analysis

max time kernel
154s
max time network
156s
platform
windows11_x64
resource
win11
submitted
10-11-2021 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Size

834KB
MD5

2c25a0926e5228d2205b3b8c8ef4d7f4
SHA1

5f8a9d364dc3d03a5b11fd5be0629d0fb5a8c409
SHA256

e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6
SHA512

cafe8fae74d414015118b838b5e4b30183733d5e833c5db84a56bd2d5cf728cad08d2bbefbeadc86b15b7dbf6dc25fcabdffa8ff4fb346dc0f66376087a28468

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3100 created 2420 3100 WerFault.exe rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2420 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3140 2420 WerFault.exe rundll32.exe

description	pid	process	target process
PID 3100 created 2420	3100	WerFault.exe	rundll32.exe

pid	process
2420	rundll32.exe

pid	pid_target	process	target process
3140	2420	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WerFault.exe

pid process

3140 WerFault.exe
3140 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3140 WerFault.exe
Token: SeBackupPrivilege 3140 WerFault.exe

pid	process
3140	WerFault.exe
3140	WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3140	WerFault.exe
Token: SeBackupPrivilege	3140	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exeWerFault.exe

description	pid	process	target process
PID 3364 wrote to memory of 2420	3364	e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe	rundll32.exe
PID 3364 wrote to memory of 2420	3364	e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe	rundll32.exe
PID 3364 wrote to memory of 2420	3364	e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe	rundll32.exe
PID 3100 wrote to memory of 2420	3100	WerFault.exe	rundll32.exe
PID 3100 wrote to memory of 2420	3100	WerFault.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
"C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" sqlite.dll,global
2⤵
- Loads dropped DLL
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 456
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2420 -ip 2420
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sqlite.dat
MD5
bbd4ce7a3b397979f6725781367e2671

SHA1
1627f36916b4a3e2384a3aa2b0af35ba9e785093

SHA256
c13e0dd5f82062a4659f6fa989b00a2d109644156675aa63e7670288723a9fe4

SHA512
b0a5708673f3077eaad552ea664f16b569b653be55865221506b537b41c77ec9b5610d3f67b996e7f2da0bd08da274dc01c9e7db2ce1ed706c18812093d76b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
d2c3e38d64273ea56d503bb3fb2a8b5d

SHA1
177da7d99381bbc83ede6b50357f53944240d862

SHA256
25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

SHA512
2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
d2c3e38d64273ea56d503bb3fb2a8b5d

SHA1
177da7d99381bbc83ede6b50357f53944240d862

SHA256
25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

SHA512
2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

Download Submit
memory/2420-148-0x0000000000000000-mapping.dmp

Download
memory/3364-146-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/3364-147-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download