Analysis
-
max time kernel
4265076s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
17-01-2022 01:13
Static task
static1
Behavioral task
behavioral1
Sample
stage2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
stage2.exe
Resource
win10v2004-en-20220112
General
-
Target
stage2.exe
-
Size
209KB
-
MD5
14c8482f302b5e81e3fa1b18a509289d
-
SHA1
16525cb2fd86dce842107eb1ba6174b23f188537
-
SHA256
dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78
-
SHA512
fdaaac4ee73db90f69dc43a20f24d8f80a2f659288d28538c6fd1946b8861bb161b41ad3bcd65d16843cd21350e95c606f991a990110e100029b58abce978353
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2828 created 3024 2828 WerFault.exe stage2.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
stage2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation stage2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3572 3024 WerFault.exe stage2.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotification.exeWerFault.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotification.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotification.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exeWerFault.exepid process 228 powershell.exe 228 powershell.exe 3896 powershell.exe 3896 powershell.exe 3572 WerFault.exe 3572 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exeMusNotification.exepowershell.exestage2.exeWerFault.exedescription pid process Token: SeDebugPrivilege 228 powershell.exe Token: SeShutdownPrivilege 2944 MusNotification.exe Token: SeCreatePagefilePrivilege 2944 MusNotification.exe Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 3024 stage2.exe Token: SeRestorePrivilege 3572 WerFault.exe Token: SeBackupPrivilege 3572 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
stage2.exeWerFault.exedescription pid process target process PID 3024 wrote to memory of 228 3024 stage2.exe powershell.exe PID 3024 wrote to memory of 228 3024 stage2.exe powershell.exe PID 3024 wrote to memory of 228 3024 stage2.exe powershell.exe PID 3024 wrote to memory of 3896 3024 stage2.exe powershell.exe PID 3024 wrote to memory of 3896 3024 stage2.exe powershell.exe PID 3024 wrote to memory of 3896 3024 stage2.exe powershell.exe PID 2828 wrote to memory of 3024 2828 WerFault.exe stage2.exe PID 2828 wrote to memory of 3024 2828 WerFault.exe stage2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\stage2.exe"C:\Users\Admin\AppData\Local\Temp\stage2.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 20242⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3024 -ip 30241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
4280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
8c49aa584665d82d54bbce04490352ce
SHA1298e08258daa2429641fb1f5dbe78cc5edfba3bb
SHA2569f4cca0b32f595a1a1b2cdfdacd86e9705f3075699ab4a72cc12e1fab468d6c1
SHA51273be18dadc852ec4c9ba57824868c676f481062e7213180434502888d40bae78d39a554ed39a041d15867e144c3e76667c47c41e75657aafeda16d86060ff5e8
-
memory/228-139-0x0000000006E42000-0x0000000006E43000-memory.dmpFilesize
4KB
-
memory/228-147-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/228-135-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/228-134-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/228-133-0x0000000000000000-mapping.dmp
-
memory/228-137-0x0000000004CF0000-0x0000000004D26000-memory.dmpFilesize
216KB
-
memory/228-138-0x0000000007480000-0x0000000007AA8000-memory.dmpFilesize
6.2MB
-
memory/228-141-0x0000000007C20000-0x0000000007C86000-memory.dmpFilesize
408KB
-
memory/228-140-0x0000000007220000-0x0000000007242000-memory.dmpFilesize
136KB
-
memory/228-136-0x0000000006E40000-0x0000000006E41000-memory.dmpFilesize
4KB
-
memory/228-142-0x0000000007C90000-0x0000000007CF6000-memory.dmpFilesize
408KB
-
memory/228-143-0x00000000082C0000-0x00000000082DE000-memory.dmpFilesize
120KB
-
memory/228-144-0x0000000009920000-0x0000000009F9A000-memory.dmpFilesize
6.5MB
-
memory/228-145-0x00000000087E0000-0x00000000087FA000-memory.dmpFilesize
104KB
-
memory/228-146-0x0000000006E45000-0x0000000006E47000-memory.dmpFilesize
8KB
-
memory/3024-131-0x0000000000C50000-0x0000000000C80000-memory.dmpFilesize
192KB
-
memory/3024-165-0x0000000005670000-0x0000000005C14000-memory.dmpFilesize
5.6MB
-
memory/3024-130-0x0000000000C50000-0x0000000000C80000-memory.dmpFilesize
192KB
-
memory/3024-132-0x0000000005C20000-0x00000000061C4000-memory.dmpFilesize
5.6MB
-
memory/3896-156-0x0000000007840000-0x00000000078A6000-memory.dmpFilesize
408KB
-
memory/3896-159-0x0000000006880000-0x0000000006881000-memory.dmpFilesize
4KB
-
memory/3896-153-0x0000000006EC0000-0x00000000074E8000-memory.dmpFilesize
6.2MB
-
memory/3896-154-0x0000000007530000-0x0000000007552000-memory.dmpFilesize
136KB
-
memory/3896-155-0x0000000007700000-0x0000000007766000-memory.dmpFilesize
408KB
-
memory/3896-150-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/3896-148-0x0000000000000000-mapping.dmp
-
memory/3896-152-0x0000000006740000-0x0000000006776000-memory.dmpFilesize
216KB
-
memory/3896-158-0x0000000007D50000-0x0000000007D6E000-memory.dmpFilesize
120KB
-
memory/3896-160-0x0000000006882000-0x0000000006883000-memory.dmpFilesize
4KB
-
memory/3896-161-0x0000000006885000-0x0000000006887000-memory.dmpFilesize
8KB
-
memory/3896-162-0x0000000009680000-0x0000000009CFA000-memory.dmpFilesize
6.5MB
-
memory/3896-163-0x00000000081E0000-0x00000000081FA000-memory.dmpFilesize
104KB
-
memory/3896-164-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/3896-151-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB