f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5

Analysis

max time kernel
150s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5.exe
Size

1.8MB
MD5

3c24dd3aeecda6634fcd0795c9efad25
SHA1

f832dc72a0ee21f5b54097a8746b0720be450a16
SHA256

f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5
SHA512

6527c7fca467e89d777914608977d3c753e54b623f06c64d67df217ecc22d10f47b9d5e39626addd3f32a51c23b541d71d2d81a183270f00b8271f56ee41df48
SSDEEP

49152:EgPY/gWJU8inIxGt+WbgMLz/oB88QkaoY2TQ1K9f0JDMG:iiIAt+GDLz/Q9aoC1KuJDM

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Wine	f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2728	f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 25 IoCs

pid	pid_target	Process	procid_target
1312	2728	WerFault.exe	78
1048	2728	WerFault.exe	78
4576	2728	WerFault.exe	78
2828	2728	WerFault.exe	78
4384	2728	WerFault.exe	78
4500	2728	WerFault.exe	78
4560	2728	WerFault.exe	78
1052	2728	WerFault.exe	78
1268	2728	WerFault.exe	78
544	2728	WerFault.exe	78
5100	2728	WerFault.exe	78
3336	2728	WerFault.exe	78
1848	2728	WerFault.exe	78
4724	2728	WerFault.exe	78
588	2728	WerFault.exe	78
1480	2728	WerFault.exe	78
1648	2728	WerFault.exe	78
1508	2728	WerFault.exe	78
820	2728	WerFault.exe	78
2404	2728	WerFault.exe	78
3860	2728	WerFault.exe	78
4900	2728	WerFault.exe	78
4536	2728	WerFault.exe	78
1500	2728	WerFault.exe	78
4288	2728	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2728	f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5.exe
2728	f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5.exe

C:\Users\Admin\AppData\Local\Temp\f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5.exe
"C:\Users\Admin\AppData\Local\Temp\f30a867942507beb73c0870195da6c4a5a937781c5e07c279ea2f0c1d391e9c5.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 220
  2⤵
  - Program crash
  PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 240
  2⤵
  - Program crash
  PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 248
  2⤵
  - Program crash
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 504
  2⤵
  - Program crash
  PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 528
  2⤵
  - Program crash
  PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 536
  2⤵
  - Program crash
  PID:4500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 512
  2⤵
  - Program crash
  PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 240
  2⤵
  - Program crash
  PID:1052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 540
  2⤵
  - Program crash
  PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 564
  2⤵
  - Program crash
  PID:544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 528
  2⤵
  - Program crash
  PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 548
  2⤵
  - Program crash
  PID:3336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 524
  2⤵
  - Program crash
  PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 504
  2⤵
  - Program crash
  PID:4724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 544
  2⤵
  - Program crash
  PID:588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 560
  2⤵
  - Program crash
  PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 536
  2⤵
  - Program crash
  PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 500
  2⤵
  - Program crash
  PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 520
  2⤵
  - Program crash
  PID:820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 560
  2⤵
  - Program crash
  PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 512
  2⤵
  - Program crash
  PID:3860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 524
  2⤵
  - Program crash
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 504
  2⤵
  - Program crash
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 532
  2⤵
  - Program crash
  PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 524
  2⤵
  - Program crash
  PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2728 -ip 2728
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2728 -ip 2728
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2728 -ip 2728
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2728 -ip 2728
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2728 -ip 2728
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2728 -ip 2728
1⤵
PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2728 -ip 2728
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2728 -ip 2728
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2728 -ip 2728
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2728 -ip 2728
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2728 -ip 2728
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2728 -ip 2728
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2728 -ip 2728
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2728 -ip 2728
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2728 -ip 2728
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2728 -ip 2728
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2728 -ip 2728
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2728 -ip 2728
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2728 -ip 2728
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2728 -ip 2728
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2728 -ip 2728
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2728 -ip 2728
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2728 -ip 2728
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2728 -ip 2728
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2728 -ip 2728
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-132-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2728-133-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2728-134-0x00000000778C0000-0x0000000077A63000-memory.dmp

Filesize
1.6MB

Download
memory/2728-135-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2728-136-0x00000000778C0000-0x0000000077A63000-memory.dmp

Filesize
1.6MB

Download
memory/2728-137-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2728-138-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2728-139-0x00000000778C0000-0x0000000077A63000-memory.dmp

Filesize
1.6MB

Download