5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae

General

Target

5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
Size

396KB
MD5

618401a3ca724ed8a9a90225cce96952
SHA1

eef0affeb74ef0957bf346226324da93fe028062
SHA256

5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae
SHA512

c61f4dd4264deafe982e5cfdef4875e7d667b1c7b7d64b89155a9b95a5410282d674666855da23d1663ebadd33082a64591686bb0aa924e49ccfd6ec4b1add90

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4560	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
5104	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
4692	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
4652	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
644	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
4920	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
3252	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
4732	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
4724	2428	WerFault.exe	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2084 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2084 taskkill.exe

pid	process
2084	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2084	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.execmd.exe

description	pid	process	target process
PID 2428 wrote to memory of 1040	2428	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe	cmd.exe
PID 2428 wrote to memory of 1040	2428	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe	cmd.exe
PID 2428 wrote to memory of 1040	2428	5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe	cmd.exe
PID 1040 wrote to memory of 2084	1040	cmd.exe	taskkill.exe
PID 1040 wrote to memory of 2084	1040	cmd.exe	taskkill.exe
PID 1040 wrote to memory of 2084	1040	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe
"C:\Users\Admin\AppData\Local\Temp\5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 456
2⤵
- Program crash
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 776
2⤵
- Program crash
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 812
2⤵
- Program crash
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 812
2⤵
- Program crash
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 792
2⤵
- Program crash
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 928
2⤵
- Program crash
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1000
2⤵
- Program crash
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1356
2⤵
- Program crash
PID:4732

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "5de8702ec404c2b16a73a18095c9aaa405ed920001c38d65068bc930992be3ae.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1460
2⤵
- Program crash
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2428 -ip 2428
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2428 -ip 2428
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2428 -ip 2428
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2428 -ip 2428
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2428 -ip 2428
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2428 -ip 2428
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2428 -ip 2428
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2428 -ip 2428
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2428 -ip 2428
1⤵
PID:212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-133-0x0000000000000000-mapping.dmp

Download
memory/2084-134-0x0000000000000000-mapping.dmp

Download
memory/2428-130-0x0000000000D4D000-0x0000000000D73000-memory.dmp

Filesize
152KB

Download
memory/2428-131-0x0000000000CF0000-0x0000000000D2F000-memory.dmp

Filesize
252KB

Download
memory/2428-132-0x0000000000400000-0x0000000000B56000-memory.dmp

Filesize
7.3MB

Download
memory/2428-135-0x0000000000D4D000-0x0000000000D73000-memory.dmp

Filesize
152KB

Download
memory/2428-136-0x0000000000400000-0x0000000000B56000-memory.dmp

Filesize
7.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads