dc3d32b45e2a3ff1ff5e722741c6229c5f62b397a23dbc02990a6be7bb7bc718

Analysis

max time kernel
134s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
28/03/2022, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
root.exe
Size 1.1MB
Sample220328-ycdmgsachq
SHA256 dc3d32b45e2a3ff1ff5e722741c6229c5f62b397a23dbc02990a6be7bb7bc718
MD5 f90efb3dd7f9866b14e9bd520a9701e4
SHA1 f1182246270ba8de565d5bf54d912d02cabbbe39
SHA512 3c38a9371758254f9c9eb572548bfee2200f1e8584e554fdf3f8ebbb87c8ab8b3e9d729be8c4b07cb2dd76e6a9cec3e41e09d6919917798bd4c3b3bcc86c83f6
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
163	4684	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3444	4368	WerFault.exe	82
4056	4368	WerFault.exe	82
2440	4368	WerFault.exe	82
3848	4368	WerFault.exe	82
1752	4368	WerFault.exe	82
2328	4368	WerFault.exe	82

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	root.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	root.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	root.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	root.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	root.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	root.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	root.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	root.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98
PID 4368 wrote to memory of 4684	4368	root.exe	98

C:\Users\Admin\AppData\Local\Temp\root.exe
"C:\Users\Admin\AppData\Local\Temp\root.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  PID:4684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 608
  2⤵
  - Program crash
  PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 908
  2⤵
  - Program crash
  PID:4056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 908
  2⤵
  - Program crash
  PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1044
  2⤵
  - Program crash
  PID:3848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1052
  2⤵
  - Program crash
  PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1028
  2⤵
  - Program crash
  PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4368 -ip 4368
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4368 -ip 4368
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4368 -ip 4368
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4368 -ip 4368
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4368 -ip 4368
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4368 -ip 4368
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Qyrfadqpuepoow.tmp

Path C:\Users\Admin\AppData\Local\Temp\Qyrfadqpuepoow.tmp
Size 3.1MB
SHA256 808fcecfff0d41a6549f057febf5c0fc76cae2aa8780903c257b04ee66c30a2b
MD5 522b47b5f646bab02e6876bff9629166
SHA1 6e171a47e047d15fc7369031546c365deb4ca639
SHA512 e79c6a49f35f78b362423d96655b095db54bd72c0c018b5a1165d93e426aab43d8122690eea95951359f7b17610678d5d31f6447a514590525f0505063dc4f97
MD5 SHA1 SHA512

Submit Download

memory/4368-159-0x0000000003B30000-0x0000000003C70000-memory.dmp

Download

memory/4368-155-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/4368-137-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/4368-138-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/4368-160-0x0000000003B30000-0x0000000003C70000-memory.dmp

Download

memory/4368-134-0x00000000007DA000-0x00000000008BA000-memory.dmp

Download

memory/4368-158-0x0000000002800000-0x0000000002801000-memory.dmp

Download

memory/4368-153-0x0000000003B30000-0x0000000003C70000-memory.dmp

Download

memory/4368-136-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/4368-157-0x0000000003B30000-0x0000000003C70000-memory.dmp

Download

memory/4368-156-0x0000000003B30000-0x0000000003C70000-memory.dmp

Download

memory/4368-154-0x0000000003B30000-0x0000000003C70000-memory.dmp

Download

memory/4368-135-0x0000000002460000-0x000000000268A000-memory.dmp

Download

memory/4368-148-0x0000000003020000-0x0000000003A66000-memory.dmp

Download

memory/4368-149-0x0000000003020000-0x0000000003A66000-memory.dmp

Download

memory/4368-150-0x0000000003C80000-0x0000000003C81000-memory.dmp

Download

memory/4368-152-0x0000000002D60000-0x0000000002D61000-memory.dmp

Download

memory/4368-151-0x0000000003020000-0x0000000003A66000-memory.dmp

Download

memory/4684-140-0x00000000006D0000-0x00000000006D4000-memory.dmp

Download

memory/4684-146-0x0000000000730000-0x0000000000734000-memory.dmp

Download

memory/4684-145-0x0000000000720000-0x0000000000724000-memory.dmp

Download

memory/4684-143-0x0000000000700000-0x0000000000704000-memory.dmp

Download

memory/4684-144-0x0000000000710000-0x0000000000714000-memory.dmp

Download

memory/4684-141-0x00000000006E0000-0x00000000006E4000-memory.dmp

Download

memory/4684-142-0x00000000006F0000-0x00000000006F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads