Analysis

  • max time kernel
    90s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 16:08

General

  • Target

    e2a6ef91a504d25344b262cbc9227dae.exe

  • Size

    391KB

  • MD5

    e2a6ef91a504d25344b262cbc9227dae

  • SHA1

    40c8d448535184d15911d92c604e664101a54795

  • SHA256

    26d46c6b97e45b6d82e5c47ed3725fed18d6c9113b1f7bcbe5b880e562a95863

  • SHA512

    d754847b86da66d4ef7d7cfe19ca436371dcda2c2417b1e915980f7bf3d51792846a733682f918879b7b42949f2593fa4de802a891d5ad268c9f647a5e9c6e83

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2a6ef91a504d25344b262cbc9227dae.exe
    "C:\Users\Admin\AppData\Local\Temp\e2a6ef91a504d25344b262cbc9227dae.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 616
      2⤵
      • Program crash
      PID:3864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 736
      2⤵
      • Program crash
      PID:5040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 924
      2⤵
      • Program crash
      PID:4168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 932
      2⤵
      • Program crash
      PID:2136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 756
      2⤵
      • Program crash
      PID:4072
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 968
      2⤵
      • Program crash
      PID:2116
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "e2a6ef91a504d25344b262cbc9227dae.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\e2a6ef91a504d25344b262cbc9227dae.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "e2a6ef91a504d25344b262cbc9227dae.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 740
      2⤵
      • Program crash
      PID:3464
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4044 -ip 4044
    1⤵
      PID:3404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4044 -ip 4044
      1⤵
        PID:4644
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4044 -ip 4044
        1⤵
          PID:5088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4044 -ip 4044
          1⤵
            PID:5048
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4044 -ip 4044
            1⤵
              PID:448
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4044 -ip 4044
              1⤵
                PID:2284
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4044 -ip 4044
                1⤵
                  PID:4060

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/1964-134-0x0000000000000000-mapping.dmp

                • memory/4044-130-0x0000000000662000-0x0000000000688000-memory.dmp

                  Filesize

                  152KB

                • memory/4044-131-0x0000000000850000-0x000000000088F000-memory.dmp

                  Filesize

                  252KB

                • memory/4044-132-0x0000000000400000-0x00000000004A3000-memory.dmp

                  Filesize

                  652KB

                • memory/4264-133-0x0000000000000000-mapping.dmp