Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
01-12-2021 14:12
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document.jpg.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Shipping Document.jpg.exe
Resource
win10-en-20211104
General
-
Target
Shipping Document.jpg.exe
-
Size
535KB
-
MD5
0bedced4f80f29a3a4eacf08a57a7d1a
-
SHA1
f3aa3d1a2cd8478e9900f8e40568a073ecccf50b
-
SHA256
2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1
-
SHA512
2058cd590d6f843bcc101ab3a12368fbf3b35e8bc40e0e8c05932aa1b0627f2cac8a2e8e07dad3b095089351b9b7843e9a8d9d62f503997a7d746ce9a998e716
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1164 1728 WerFault.exe Shipping Document.jpg.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
WerFault.exepowershell.exepid process 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
WerFault.exepowershell.exedescription pid process Token: SeDebugPrivilege 1164 WerFault.exe Token: SeDebugPrivilege 624 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Shipping Document.jpg.exedescription pid process target process PID 1728 wrote to memory of 624 1728 Shipping Document.jpg.exe powershell.exe PID 1728 wrote to memory of 624 1728 Shipping Document.jpg.exe powershell.exe PID 1728 wrote to memory of 624 1728 Shipping Document.jpg.exe powershell.exe PID 1728 wrote to memory of 624 1728 Shipping Document.jpg.exe powershell.exe PID 1728 wrote to memory of 1084 1728 Shipping Document.jpg.exe schtasks.exe PID 1728 wrote to memory of 1084 1728 Shipping Document.jpg.exe schtasks.exe PID 1728 wrote to memory of 1084 1728 Shipping Document.jpg.exe schtasks.exe PID 1728 wrote to memory of 1084 1728 Shipping Document.jpg.exe schtasks.exe PID 1728 wrote to memory of 1164 1728 Shipping Document.jpg.exe WerFault.exe PID 1728 wrote to memory of 1164 1728 Shipping Document.jpg.exe WerFault.exe PID 1728 wrote to memory of 1164 1728 Shipping Document.jpg.exe WerFault.exe PID 1728 wrote to memory of 1164 1728 Shipping Document.jpg.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document.jpg.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BwvLWCLsGodg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BwvLWCLsGodg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC497.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 9802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC497.tmpMD5
e8470696c5aa3e7aa716b87fee337307
SHA18b5e6f7242079429b48cb2ef2946c9b974839f63
SHA2562f14495e1b9f70d492760b26f23f0966e1a251df19ebdba04bdb010a65facb37
SHA512a64e9a6539dc77e4e14f21c44125637751d7057e04afa0a76f0bfd09f544b22eb5f6c943fbb64904ccea46c9d1d06847b6bd42cceff07b00d80d625ed7d7791f
-
memory/624-61-0x0000000000000000-mapping.dmp
-
memory/624-68-0x00000000023F2000-0x00000000023F4000-memory.dmpFilesize
8KB
-
memory/624-66-0x00000000023F1000-0x00000000023F2000-memory.dmpFilesize
4KB
-
memory/624-65-0x00000000023F0000-0x00000000023F1000-memory.dmpFilesize
4KB
-
memory/1084-63-0x0000000000000000-mapping.dmp
-
memory/1164-67-0x0000000000000000-mapping.dmp
-
memory/1164-69-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/1728-55-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1728-60-0x0000000002040000-0x0000000002084000-memory.dmpFilesize
272KB
-
memory/1728-59-0x0000000000390000-0x0000000000396000-memory.dmpFilesize
24KB
-
memory/1728-58-0x0000000004360000-0x0000000004361000-memory.dmpFilesize
4KB
-
memory/1728-57-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB