Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
01-12-2021 14:12
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document.jpg.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
Shipping Document.jpg.exe
Resource
win10-en-20211104
General
-
Target
Shipping Document.jpg.exe
-
Size
535KB
-
MD5
0bedced4f80f29a3a4eacf08a57a7d1a
-
SHA1
f3aa3d1a2cd8478e9900f8e40568a073ecccf50b
-
SHA256
2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1
-
SHA512
2058cd590d6f843bcc101ab3a12368fbf3b35e8bc40e0e8c05932aa1b0627f2cac8a2e8e07dad3b095089351b9b7843e9a8d9d62f503997a7d746ce9a998e716
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1512 1724 WerFault.exe Shipping Document.jpg.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
WerFault.exepowershell.exepid process 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1512 WerFault.exe 1936 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1512 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
WerFault.exepowershell.exedescription pid process Token: SeDebugPrivilege 1512 WerFault.exe Token: SeDebugPrivilege 1936 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Shipping Document.jpg.exedescription pid process target process PID 1724 wrote to memory of 1936 1724 Shipping Document.jpg.exe powershell.exe PID 1724 wrote to memory of 1936 1724 Shipping Document.jpg.exe powershell.exe PID 1724 wrote to memory of 1936 1724 Shipping Document.jpg.exe powershell.exe PID 1724 wrote to memory of 1936 1724 Shipping Document.jpg.exe powershell.exe PID 1724 wrote to memory of 1796 1724 Shipping Document.jpg.exe schtasks.exe PID 1724 wrote to memory of 1796 1724 Shipping Document.jpg.exe schtasks.exe PID 1724 wrote to memory of 1796 1724 Shipping Document.jpg.exe schtasks.exe PID 1724 wrote to memory of 1796 1724 Shipping Document.jpg.exe schtasks.exe PID 1724 wrote to memory of 1512 1724 Shipping Document.jpg.exe WerFault.exe PID 1724 wrote to memory of 1512 1724 Shipping Document.jpg.exe WerFault.exe PID 1724 wrote to memory of 1512 1724 Shipping Document.jpg.exe WerFault.exe PID 1724 wrote to memory of 1512 1724 Shipping Document.jpg.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document.jpg.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BwvLWCLsGodg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BwvLWCLsGodg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp54D4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 9802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp54D4.tmpMD5
1666a60de438b1ef3177b54c6caf5fb8
SHA19a7f437df16501c8ffcf40f454fb4535387ecb92
SHA25676c8473acd77f7e7bf11e5de1cb74862f4732ffabfbb59ffb5ab6004acd64bdc
SHA512f038c90e33ada81d4192be92664718a8160381352a5416b8008e8777acda847f8c43d33bbe3d788f5cbb643f2b124f5f5cb2350510f9afc61101c3bfd43d8ce4
-
memory/1512-66-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1512-64-0x0000000000000000-mapping.dmp
-
memory/1724-59-0x0000000002040000-0x0000000002084000-memory.dmpFilesize
272KB
-
memory/1724-55-0x0000000000830000-0x0000000000831000-memory.dmpFilesize
4KB
-
memory/1724-58-0x0000000000450000-0x0000000000456000-memory.dmpFilesize
24KB
-
memory/1724-57-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/1796-61-0x0000000000000000-mapping.dmp
-
memory/1936-60-0x0000000000000000-mapping.dmp
-
memory/1936-62-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1936-65-0x0000000002510000-0x000000000315A000-memory.dmpFilesize
12.3MB
-
memory/1936-67-0x0000000002510000-0x000000000315A000-memory.dmpFilesize
12.3MB
-
memory/1936-68-0x0000000002510000-0x000000000315A000-memory.dmpFilesize
12.3MB