86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4

Analysis

max time kernel
47s
max time network
42s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe
Size

238KB
MD5

2764767a2d1a56be8a9ecad34bc887e8
SHA1

b43ecacac1cdc76d38b60d56220adf34bded0a26
SHA256

86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4
SHA512

034b5da8f955550d7808329c3e83bf5a64535a6b52330076e9c0962b7b6a060f1d2c8243cd15f4546ebc0c9c4a3b4678dc89734f5fa22c0bdf342c9c7caf02c5

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

pid	process
1480	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe
1480	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

description ioc process

File opened for modification C:\Windows\win.ini 86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 1480 WerFault.exe 86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

pid	pid_target	process	target process
1980	1480	WerFault.exe	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

Modifies registry class 2 IoCs

Processes:

86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.CDAudio	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.CDAudio\ = "VLC CD Audio"	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe

description	pid	process	target process
PID 1480 wrote to memory of 1980	1480	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe	WerFault.exe
PID 1480 wrote to memory of 1980	1480	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe	WerFault.exe
PID 1480 wrote to memory of 1980	1480	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe	WerFault.exe
PID 1480 wrote to memory of 1980	1480	86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe
"C:\Users\Admin\AppData\Local\Temp\86521486374b5605dfbc8bda25a68c9c2847fedf5ca7b35e917dbdac624074b4.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 500
2⤵
- Program crash
PID:1980

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\System.dll
Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\sesquialteras.dll
Filesize
44KB

MD5
1f1358b84492a98f8bbc71893b33db2c

SHA1
cb9fafb0e6b03f96eaf7df5c54dfc5b4d98eca42

SHA256
01f983122bccc667965bd7d5573efcfc15ff30bdc2cba34b02713e73089d3fd1

SHA512
5cfc818dfe1c49cdc559909b0e41985c55f625294e12b150da422bc5b06df7793df15991b534d2efe7278871566682121bb452668837b3a39fd9b51298f90bf8

Download Submit
memory/1480-54-0x0000000076311000-0x0000000076313000-memory.dmp

Filesize
8KB

Download
memory/1480-57-0x0000000001D50000-0x0000000001D59000-memory.dmp

Filesize
36KB

Download
memory/1480-63-0x0000000002370000-0x0000000002FBA000-memory.dmp

Filesize
12.3MB

Download
memory/1480-65-0x0000000002370000-0x0000000002FBA000-memory.dmp

Filesize
12.3MB

Download
memory/1980-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads