Analysis
-
max time kernel
90s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 16:08
Static task
static1
Behavioral task
behavioral1
Sample
e2a6ef91a504d25344b262cbc9227dae.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e2a6ef91a504d25344b262cbc9227dae.exe
Resource
win10v2004-20220414-en
General
-
Target
e2a6ef91a504d25344b262cbc9227dae.exe
-
Size
391KB
-
MD5
e2a6ef91a504d25344b262cbc9227dae
-
SHA1
40c8d448535184d15911d92c604e664101a54795
-
SHA256
26d46c6b97e45b6d82e5c47ed3725fed18d6c9113b1f7bcbe5b880e562a95863
-
SHA512
d754847b86da66d4ef7d7cfe19ca436371dcda2c2417b1e915980f7bf3d51792846a733682f918879b7b42949f2593fa4de802a891d5ad268c9f647a5e9c6e83
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e2a6ef91a504d25344b262cbc9227dae.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation e2a6ef91a504d25344b262cbc9227dae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3864 4044 WerFault.exe e2a6ef91a504d25344b262cbc9227dae.exe 5040 4044 WerFault.exe e2a6ef91a504d25344b262cbc9227dae.exe 4168 4044 WerFault.exe e2a6ef91a504d25344b262cbc9227dae.exe 2136 4044 WerFault.exe e2a6ef91a504d25344b262cbc9227dae.exe 4072 4044 WerFault.exe e2a6ef91a504d25344b262cbc9227dae.exe 2116 4044 WerFault.exe e2a6ef91a504d25344b262cbc9227dae.exe 3464 4044 WerFault.exe e2a6ef91a504d25344b262cbc9227dae.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1964 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1964 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e2a6ef91a504d25344b262cbc9227dae.execmd.exedescription pid process target process PID 4044 wrote to memory of 4264 4044 e2a6ef91a504d25344b262cbc9227dae.exe cmd.exe PID 4044 wrote to memory of 4264 4044 e2a6ef91a504d25344b262cbc9227dae.exe cmd.exe PID 4044 wrote to memory of 4264 4044 e2a6ef91a504d25344b262cbc9227dae.exe cmd.exe PID 4264 wrote to memory of 1964 4264 cmd.exe taskkill.exe PID 4264 wrote to memory of 1964 4264 cmd.exe taskkill.exe PID 4264 wrote to memory of 1964 4264 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2a6ef91a504d25344b262cbc9227dae.exe"C:\Users\Admin\AppData\Local\Temp\e2a6ef91a504d25344b262cbc9227dae.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 6162⤵
- Program crash
PID:3864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 7362⤵
- Program crash
PID:5040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 9242⤵
- Program crash
PID:4168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 9322⤵
- Program crash
PID:2136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 7562⤵
- Program crash
PID:4072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 9682⤵
- Program crash
PID:2116
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e2a6ef91a504d25344b262cbc9227dae.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\e2a6ef91a504d25344b262cbc9227dae.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e2a6ef91a504d25344b262cbc9227dae.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 7402⤵
- Program crash
PID:3464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4044 -ip 40441⤵PID:3404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4044 -ip 40441⤵PID:4644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4044 -ip 40441⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4044 -ip 40441⤵PID:5048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4044 -ip 40441⤵PID:448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4044 -ip 40441⤵PID:2284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4044 -ip 40441⤵PID:4060