54dd0b1767570b23927b3959b1b53e2184b604eec29f168ca5f2b644a438309f

Analysis

Target

bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exe
Size

8KB
MD5

8c9e935bccc4fac6b11920ef96927aac
SHA1

38bd94eb5a5ef481a1e7c5192d9f824b7a16d792
SHA256

bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09
SHA512

cfd3f54aa0d8cc53388c3fe9e663a6b89a447c38873a3ccf7d658468928c9967e5c1ae7d2f4775ceb5d9b5553c640020fc858ea609190d61df68dec0cc3f2884

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1800 472 WerFault.exe bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1800 WerFault.exe
1800 WerFault.exe
1800 WerFault.exe
1800 WerFault.exe
1800 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1800 WerFault.exe

pid	pid_target	process	target process
1800	472	WerFault.exe	bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exe

pid	process
1800	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	472	bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exe
Token: SeDebugPrivilege	1800	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exe

description	pid	process	target process
PID 472 wrote to memory of 1800	472	bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exe	WerFault.exe
PID 472 wrote to memory of 1800	472	bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exe	WerFault.exe
PID 472 wrote to memory of 1800	472	bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09.exe	WerFault.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/472-55-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/472-57-0x000000001B260000-0x000000001B262000-memory.dmp

Filesize
8KB

Download
memory/1800-58-0x0000000000000000-mapping.dmp

Download
memory/1800-59-0x000007FEFB831000-0x000007FEFB833000-memory.dmp

Filesize
8KB

Download
memory/1800-60-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download