Analysis
-
max time kernel
4265056s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
16-01-2022 21:43
Static task
static1
Behavioral task
behavioral1
Sample
test1.exe
Resource
win10v2004-en-20220112
General
-
Target
test1.exe
-
Size
209KB
-
MD5
14c8482f302b5e81e3fa1b18a509289d
-
SHA1
16525cb2fd86dce842107eb1ba6174b23f188537
-
SHA256
dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78
-
SHA512
fdaaac4ee73db90f69dc43a20f24d8f80a2f659288d28538c6fd1946b8861bb161b41ad3bcd65d16843cd21350e95c606f991a990110e100029b58abce978353
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1672 created 1600 1672 WerFault.exe test1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
test1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation test1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3344 1600 WerFault.exe test1.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeMusNotification.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotification.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotification.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exeWerFault.exepid process 2908 powershell.exe 2908 powershell.exe 3872 powershell.exe 3872 powershell.exe 3344 WerFault.exe 3344 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exeMusNotification.exepowershell.exetest1.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2908 powershell.exe Token: SeShutdownPrivilege 1468 MusNotification.exe Token: SeCreatePagefilePrivilege 1468 MusNotification.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeDebugPrivilege 1600 test1.exe Token: SeRestorePrivilege 3344 WerFault.exe Token: SeBackupPrivilege 3344 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
test1.exeWerFault.exedescription pid process target process PID 1600 wrote to memory of 2908 1600 test1.exe powershell.exe PID 1600 wrote to memory of 2908 1600 test1.exe powershell.exe PID 1600 wrote to memory of 2908 1600 test1.exe powershell.exe PID 1600 wrote to memory of 3872 1600 test1.exe powershell.exe PID 1600 wrote to memory of 3872 1600 test1.exe powershell.exe PID 1600 wrote to memory of 3872 1600 test1.exe powershell.exe PID 1672 wrote to memory of 1600 1672 WerFault.exe test1.exe PID 1672 wrote to memory of 1600 1672 WerFault.exe test1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 20442⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1600 -ip 16001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
4280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
4bdae8faa54841817a8dd679e707f3da
SHA10bd145fe559befb77a5f8e0a7044de03c2572867
SHA2567106ef5a35cac41fe109ccf69c1381eadedc16203ced603ef57eaa83f62d133e
SHA512f3fb7a51c9e0174fb4dabdaf572de1a293df52776f14d3cf4d39722293be1a744c6b25730c62098c383c3af4f6d87276fe577885b624b140b4d98686c128b2ed
-
memory/1600-131-0x0000000000270000-0x00000000002A0000-memory.dmpFilesize
192KB
-
memory/1600-132-0x0000000005260000-0x0000000005804000-memory.dmpFilesize
5.6MB
-
memory/1600-165-0x0000000004CB0000-0x0000000005254000-memory.dmpFilesize
5.6MB
-
memory/1600-130-0x0000000000270000-0x00000000002A0000-memory.dmpFilesize
192KB
-
memory/2908-140-0x0000000007C70000-0x0000000007C92000-memory.dmpFilesize
136KB
-
memory/2908-143-0x00000000084C0000-0x00000000084DE000-memory.dmpFilesize
120KB
-
memory/2908-137-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/2908-139-0x0000000007640000-0x0000000007C68000-memory.dmpFilesize
6.2MB
-
memory/2908-136-0x0000000004EC0000-0x0000000004EF6000-memory.dmpFilesize
216KB
-
memory/2908-141-0x0000000007D10000-0x0000000007D76000-memory.dmpFilesize
408KB
-
memory/2908-142-0x0000000007D80000-0x0000000007DE6000-memory.dmpFilesize
408KB
-
memory/2908-138-0x0000000004F12000-0x0000000004F13000-memory.dmpFilesize
4KB
-
memory/2908-144-0x0000000009D00000-0x000000000A37A000-memory.dmpFilesize
6.5MB
-
memory/2908-145-0x00000000089C0000-0x00000000089DA000-memory.dmpFilesize
104KB
-
memory/2908-146-0x0000000004F15000-0x0000000004F17000-memory.dmpFilesize
8KB
-
memory/2908-147-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/2908-135-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/2908-134-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/2908-133-0x0000000000000000-mapping.dmp
-
memory/3872-148-0x0000000000000000-mapping.dmp
-
memory/3872-152-0x0000000004E80000-0x0000000004EB6000-memory.dmpFilesize
216KB
-
memory/3872-153-0x00000000076B0000-0x0000000007CD8000-memory.dmpFilesize
6.2MB
-
memory/3872-155-0x0000000005032000-0x0000000005033000-memory.dmpFilesize
4KB
-
memory/3872-154-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/3872-156-0x00000000075B0000-0x00000000075D2000-memory.dmpFilesize
136KB
-
memory/3872-158-0x0000000007F00000-0x0000000007F66000-memory.dmpFilesize
408KB
-
memory/3872-157-0x0000000007E90000-0x0000000007EF6000-memory.dmpFilesize
408KB
-
memory/3872-151-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/3872-160-0x00000000084F0000-0x000000000850E000-memory.dmpFilesize
120KB
-
memory/3872-161-0x0000000009D40000-0x000000000A3BA000-memory.dmpFilesize
6.5MB
-
memory/3872-162-0x0000000008960000-0x000000000897A000-memory.dmpFilesize
104KB
-
memory/3872-163-0x0000000005035000-0x0000000005037000-memory.dmpFilesize
8KB
-
memory/3872-164-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/3872-150-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB