Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
24-02-2022 11:14
Static task
static1
Behavioral task
behavioral1
Sample
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe
Resource
win10-20220223-en
windows10_x64
0 signatures
0 seconds
General
-
Target
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe
-
Size
267KB
-
MD5
ec3a003082a19fd6a00f84df315d18a2
-
SHA1
e7268a6982c3d17aaf472b331b67fbdbc4000dec
-
SHA256
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143
-
SHA512
d3e804add5ebf3efdbf4794cbc1cc53bfc0485298771a1f43d7d683870f82561be3387d83436cf308e260bd600ce475998add0d094d63ab46f3dd75ad16f74aa
Malware Config
Signatures
-
PlugX Rat Payload 4 IoCs
resource yara_rule behavioral3/memory/2540-141-0x0000000000500000-0x0000000000527000-memory.dmp PlugX behavioral3/memory/4712-142-0x00000000020A0000-0x00000000020C7000-memory.dmp PlugX behavioral3/memory/1480-144-0x0000000000CC0000-0x0000000000CE5000-memory.dmp PlugX behavioral3/memory/4464-146-0x0000000000FB0000-0x0000000000FD5000-memory.dmp PlugX -
Executes dropped EXE 2 IoCs
pid Process 4712 Mc.exe 2540 Mc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe -
Loads dropped DLL 2 IoCs
pid Process 4712 Mc.exe 2540 Mc.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\ntkrnlmp.pdb WerFault.exe -
Drops file in Windows directory 47 IoCs
description ioc Process File created C:\Windows\INF\netvwifibus.PNF WerFault.exe File created C:\Windows\INF\cht4sx64.PNF WerFault.exe File created C:\Windows\INF\mvumis.PNF WerFault.exe File created C:\Windows\INF\hidbthle.PNF WerFault.exe File created C:\Windows\INF\sisraid4.PNF WerFault.exe File created C:\Windows\INF\netsstpa.PNF WerFault.exe File created C:\Windows\INF\vrd.PNF WerFault.exe File created C:\Windows\INF\wvmbushid.PNF WerFault.exe File created C:\Windows\INF\amdsata.PNF WerFault.exe File created C:\Windows\INF\microsoft_bluetooth_hfp_hf.PNF WerFault.exe File created C:\Windows\INF\whyperkbd.PNF WerFault.exe File created C:\Windows\INF\ItSas35i.PNF WerFault.exe File created C:\Windows\INF\percsas3i.PNF WerFault.exe File created C:\Windows\INF\sdbus.PNF WerFault.exe File created C:\Windows\INF\vhdmp.PNF WerFault.exe File created C:\Windows\INF\vsmraid.PNF WerFault.exe File created C:\Windows\INF\3ware.PNF WerFault.exe File created C:\Windows\INF\wvmbusvideo.PNF WerFault.exe File created C:\Windows\INF\lsi_sas2i.PNF WerFault.exe File created C:\Windows\INF\megasas2i.PNF WerFault.exe File created C:\Windows\INF\ws3cap.PNF WerFault.exe File created C:\Windows\INF\percsas2i.PNF WerFault.exe File created C:\Windows\INF\SmartSAMD.PNF WerFault.exe File created C:\Windows\LiveKernelReports\NDIS\NDIS-20220224-1116.dmp WerFault.exe File created C:\Windows\INF\netrasa.PNF WerFault.exe File created C:\Windows\INF\wdmvsc.PNF WerFault.exe File created C:\Windows\INF\whvcrash.PNF WerFault.exe File created C:\Windows\INF\lsi_sas.PNF WerFault.exe File created C:\Windows\INF\lsi_sss.PNF WerFault.exe File created C:\Windows\INF\pcmcia.PNF WerFault.exe File created C:\Windows\INF\sisraid2.PNF WerFault.exe File created C:\Windows\INF\adp80xx.PNF WerFault.exe File created C:\Windows\INF\microsoft_bluetooth_a2dp_src.PNF WerFault.exe File created C:\Windows\INF\bthspp.PNF WerFault.exe File created C:\Windows\INF\hpsamd.PNF WerFault.exe File created C:\Windows\INF\lsi_sas3i.PNF WerFault.exe File created C:\Windows\INF\wstorvsc.PNF WerFault.exe File created C:\Windows\INF\BthLCPen.PNF WerFault.exe File created C:\Windows\INF\wnetvsc.PNF WerFault.exe File created C:\Windows\INF\nvraid.PNF WerFault.exe File created C:\Windows\INF\stexstor.PNF WerFault.exe File created C:\Windows\INF\amdsbs.PNF WerFault.exe File created C:\Windows\INF\ipmidrv.PNF WerFault.exe File created C:\Windows\INF\megasas.PNF WerFault.exe File created C:\Windows\INF\megasas35i.PNF WerFault.exe File created C:\Windows\INF\megasr.PNF WerFault.exe File created C:\Windows\INF\wsynth3dvsc.PNF WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 WerFault.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WerFault.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\XXXX svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\XXXX\CLSID = 30003200380046004300340033003900410043003000300034003500320037000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 1480 svchost.exe 1480 svchost.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 1480 svchost.exe 1480 svchost.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 1480 svchost.exe 1480 svchost.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 1480 svchost.exe 1480 svchost.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe 4464 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1480 svchost.exe 4464 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4712 Mc.exe Token: SeTcbPrivilege 4712 Mc.exe Token: SeDebugPrivilege 2540 Mc.exe Token: SeTcbPrivilege 2540 Mc.exe Token: SeDebugPrivilege 1480 svchost.exe Token: SeTcbPrivilege 1480 svchost.exe Token: SeDebugPrivilege 4464 msiexec.exe Token: SeTcbPrivilege 4464 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1436 wrote to memory of 4712 1436 8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe 82 PID 1436 wrote to memory of 4712 1436 8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe 82 PID 1436 wrote to memory of 4712 1436 8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe 82 PID 2540 wrote to memory of 1480 2540 Mc.exe 85 PID 2540 wrote to memory of 1480 2540 Mc.exe 85 PID 2540 wrote to memory of 1480 2540 Mc.exe 85 PID 2540 wrote to memory of 1480 2540 Mc.exe 85 PID 2540 wrote to memory of 1480 2540 Mc.exe 85 PID 2540 wrote to memory of 1480 2540 Mc.exe 85 PID 2540 wrote to memory of 1480 2540 Mc.exe 85 PID 2540 wrote to memory of 1480 2540 Mc.exe 85 PID 1480 wrote to memory of 4464 1480 svchost.exe 95 PID 1480 wrote to memory of 4464 1480 svchost.exe 95 PID 1480 wrote to memory of 4464 1480 svchost.exe 95 PID 1480 wrote to memory of 4464 1480 svchost.exe 95 PID 1480 wrote to memory of 4464 1480 svchost.exe 95 PID 1480 wrote to memory of 4464 1480 svchost.exe 95 PID 1480 wrote to memory of 4464 1480 svchost.exe 95 PID 1480 wrote to memory of 4464 1480 svchost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe"C:\Users\Admin\AppData\Local\Temp\8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mc.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
C:\ProgramData\MC\Mc.exeC:\ProgramData\MC\Mc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20220224-1116.dmp1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4808