Analysis
-
max time kernel
151s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31-08-2022 07:10
Static task
static1
Behavioral task
behavioral1
Sample
83970b7564a4bb507d9d764a747bb4e4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
83970b7564a4bb507d9d764a747bb4e4.exe
Resource
win10v2004-20220812-en
General
-
Target
83970b7564a4bb507d9d764a747bb4e4.exe
-
Size
433KB
-
MD5
83970b7564a4bb507d9d764a747bb4e4
-
SHA1
baa8dec2502aa980085a0472a6c122bd4af64ea6
-
SHA256
9d33270d80f2ba9d898b0b646dbaade5e1ad2de477e58cfcce74272d60a7473d
-
SHA512
251ddb825041332e89c5edb3fab35a2210f0f0ac6b8868872a44c9d731da446b960ba114226b2bafe71dc85a4c20d1122757660f6f1abd0ecd1821e598a6177b
-
SSDEEP
6144:5Llcs/PqcPPee+4DEZqVUMzuh3AdfLZUwIHccPyOz2bLNARo4ol8FzInD3:3yo4BAdtUwIHfyOuLNmonOBID3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
tmp77CF.tmp.exepid process 1708 tmp77CF.tmp.exe -
Loads dropped DLL 3 IoCs
Processes:
WerFault.exepid process 1732 WerFault.exe 1732 WerFault.exe 1732 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
83970b7564a4bb507d9d764a747bb4e4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\dllhost.exe" 83970b7564a4bb507d9d764a747bb4e4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1732 1708 WerFault.exe tmp77CF.tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
83970b7564a4bb507d9d764a747bb4e4.exepid process 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe 784 83970b7564a4bb507d9d764a747bb4e4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
83970b7564a4bb507d9d764a747bb4e4.exedescription pid process Token: SeDebugPrivilege 784 83970b7564a4bb507d9d764a747bb4e4.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
83970b7564a4bb507d9d764a747bb4e4.exetmp77CF.tmp.exedescription pid process target process PID 784 wrote to memory of 1708 784 83970b7564a4bb507d9d764a747bb4e4.exe tmp77CF.tmp.exe PID 784 wrote to memory of 1708 784 83970b7564a4bb507d9d764a747bb4e4.exe tmp77CF.tmp.exe PID 784 wrote to memory of 1708 784 83970b7564a4bb507d9d764a747bb4e4.exe tmp77CF.tmp.exe PID 784 wrote to memory of 1708 784 83970b7564a4bb507d9d764a747bb4e4.exe tmp77CF.tmp.exe PID 1708 wrote to memory of 1732 1708 tmp77CF.tmp.exe WerFault.exe PID 1708 wrote to memory of 1732 1708 tmp77CF.tmp.exe WerFault.exe PID 1708 wrote to memory of 1732 1708 tmp77CF.tmp.exe WerFault.exe PID 1708 wrote to memory of 1732 1708 tmp77CF.tmp.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83970b7564a4bb507d9d764a747bb4e4.exe"C:\Users\Admin\AppData\Local\Temp\83970b7564a4bb507d9d764a747bb4e4.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp77CF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp77CF.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 963⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp77CF.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp77CF.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp77CF.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp77CF.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
memory/784-54-0x0000000000330000-0x00000000003A2000-memory.dmpFilesize
456KB
-
memory/784-55-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/1708-56-0x0000000000000000-mapping.dmp
-
memory/1732-58-0x0000000000000000-mapping.dmp