Analysis
-
max time kernel
125s -
max time network
334s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 17:44
Static task
static1
Behavioral task
behavioral1
Sample
e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe
Resource
win10-en-20211208
General
-
Target
e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe
-
Size
160KB
-
MD5
69996b52ec0785a47c09fc8c8127c63c
-
SHA1
4e3757f8193c5f7174bda0728cc8249f74405e57
-
SHA256
e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d
-
SHA512
f6b59e8fade9876e52a061256faf8e9bdd3cf15167101ade18b5b0351c3aff2a677b98f1fed85af3e6633483b154912cdc01345064a0f0cc697a0b93fdac6413
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exedescription ioc process File opened (read-only) \??\E: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\H: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\J: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\K: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\L: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\M: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\P: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\B: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\Y: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\R: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\W: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\G: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\T: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\V: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\S: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\F: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\I: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\N: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\O: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\Q: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\U: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\X: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\A: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe File opened (read-only) \??\Z: e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2944 4008 WerFault.exe e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exeWerFault.exepid process 4008 e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe 4008 e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe 4008 e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe 4008 e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2944 WerFault.exe Token: SeBackupPrivilege 2944 WerFault.exe Token: SeDebugPrivilege 2944 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe"C:\Users\Admin\AppData\Local\Temp\e81dadfcfc8a9b12b992f216b3ed3c04bd404e77e5b690d601a27c71a7a2967d.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 6242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken