d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced

General

Target

d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe
Size

396KB
MD5

9877b157ae0bcd3feb87ccfef4253491
SHA1

a003d7ced4aa5ea3001439b6e2cd8ae9c96d1703
SHA256

d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced
SHA512

2067a09d2be11bb006cc6a2c4a509e1ded3491c06fab8a81d3d3eb67420fba1fca4853d819eec1d4fad9d2553c66c87217a2ddb3e270476ee3f9e375132215bd

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1808 2396 WerFault.exe d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe
Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

744 PING.EXE
872 PING.EXE
1092 PING.EXE
1876 PING.EXE
3140 PING.EXE
2540 PING.EXE

pid	pid_target	process	target process
1808	2396	WerFault.exe	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe

pid	process
744	PING.EXE
872	PING.EXE
1092	PING.EXE
1876	PING.EXE
3140	PING.EXE
2540	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe
Token: SeRestorePrivilege	1808	WerFault.exe
Token: SeBackupPrivilege	1808	WerFault.exe
Token: SeDebugPrivilege	1808	WerFault.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2396 wrote to memory of 2744	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 2744	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 2744	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2744 wrote to memory of 3140	2744	cmd.exe	PING.EXE
PID 2744 wrote to memory of 3140	2744	cmd.exe	PING.EXE
PID 2744 wrote to memory of 3140	2744	cmd.exe	PING.EXE
PID 2396 wrote to memory of 1764	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 1764	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 1764	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 1764 wrote to memory of 2540	1764	cmd.exe	PING.EXE
PID 1764 wrote to memory of 2540	1764	cmd.exe	PING.EXE
PID 1764 wrote to memory of 2540	1764	cmd.exe	PING.EXE
PID 2396 wrote to memory of 912	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 912	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 912	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 912 wrote to memory of 744	912	cmd.exe	PING.EXE
PID 912 wrote to memory of 744	912	cmd.exe	PING.EXE
PID 912 wrote to memory of 744	912	cmd.exe	PING.EXE
PID 2396 wrote to memory of 2960	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 2960	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 2960	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2960 wrote to memory of 872	2960	cmd.exe	PING.EXE
PID 2960 wrote to memory of 872	2960	cmd.exe	PING.EXE
PID 2960 wrote to memory of 872	2960	cmd.exe	PING.EXE
PID 2396 wrote to memory of 1464	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 1464	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 1464	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 1464 wrote to memory of 1092	1464	cmd.exe	PING.EXE
PID 1464 wrote to memory of 1092	1464	cmd.exe	PING.EXE
PID 1464 wrote to memory of 1092	1464	cmd.exe	PING.EXE
PID 2396 wrote to memory of 716	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 716	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 2396 wrote to memory of 716	2396	d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe	cmd.exe
PID 716 wrote to memory of 1876	716	cmd.exe	PING.EXE
PID 716 wrote to memory of 1876	716	cmd.exe	PING.EXE
PID 716 wrote to memory of 1876	716	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe
"C:\Users\Admin\AppData\Local\Temp\d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping youtube.com
2⤵
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\PING.EXE
ping youtube.com
3⤵
- Runs ping.exe
PID:3140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping facebook.com
2⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\PING.EXE
ping facebook.com
3⤵
- Runs ping.exe
PID:2540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping youtube.com
2⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\PING.EXE
ping youtube.com
3⤵
- Runs ping.exe
PID:744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping facebook.com
2⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\PING.EXE
ping facebook.com
3⤵
- Runs ping.exe
PID:872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping youtube.com
2⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\PING.EXE
ping youtube.com
3⤵
- Runs ping.exe
PID:1092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping facebook.com
2⤵
- Suspicious use of WriteProcessMemory
PID:716

C:\Windows\SysWOW64\PING.EXE
ping facebook.com
3⤵
- Runs ping.exe
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1916
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/716-130-0x0000000000000000-mapping.dmp

Download
memory/744-125-0x0000000000000000-mapping.dmp

Download
memory/872-127-0x0000000000000000-mapping.dmp

Download
memory/912-124-0x0000000000000000-mapping.dmp

Download
memory/1092-129-0x0000000000000000-mapping.dmp

Download
memory/1464-128-0x0000000000000000-mapping.dmp

Download
memory/1764-122-0x0000000000000000-mapping.dmp

Download
memory/1876-131-0x0000000000000000-mapping.dmp

Download
memory/2396-118-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/2396-132-0x0000000006050000-0x0000000006051000-memory.dmp

Filesize
4KB

Download
memory/2540-123-0x0000000000000000-mapping.dmp

Download
memory/2744-120-0x0000000000000000-mapping.dmp

Download
memory/2960-126-0x0000000000000000-mapping.dmp

Download
memory/3140-121-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads