Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 17:17
Static task
static1
Behavioral task
behavioral1
Sample
fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe
Resource
win10-en-20211208
General
-
Target
fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe
-
Size
160KB
-
MD5
485162da155381fedb5783f645b1fba6
-
SHA1
c55d6716292e5301e1c856a527c12e7240baf583
-
SHA256
fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270
-
SHA512
327c7a326c46c69dac4bd8b8a4037fd3fc70fd426955c1eaa70a044d0af2cec14e9013b36823d82a3493f5fb7c6f8cd91eeb6e9b3a3d67ab3ebb8b2cecdd08d0
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exedescription ioc process File opened (read-only) \??\R: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\T: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\U: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\I: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\L: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\M: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\S: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\Y: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\A: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\E: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\K: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\G: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\H: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\J: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\N: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\O: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\P: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\Q: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\V: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\B: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\F: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\Z: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\W: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe File opened (read-only) \??\X: fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 628 3192 WerFault.exe fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exeWerFault.exepid process 3192 fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe 3192 fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe 3192 fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe 3192 fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 628 WerFault.exe Token: SeBackupPrivilege 628 WerFault.exe Token: SeDebugPrivilege 628 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe"C:\Users\Admin\AppData\Local\Temp\fe56fa9266ddd1f9a864eabac6174815fd5315e6978067a4592b8949ea321270.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 6162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken