Analysis
-
max time kernel
43s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 03:12
Static task
static1
Behavioral task
behavioral1
Sample
ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe
Resource
win10v2004-20220812-en
General
-
Target
ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe
-
Size
289KB
-
MD5
0f48d335917cc7a4e32399b62b52cb67
-
SHA1
a17e462126caf9952404b064f25c882402f83824
-
SHA256
ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24
-
SHA512
27cb1158517934f7fa615922d9451b0e005c51d08274a6423f9bf03b6cbf4935637b0139bf571451cc190a9776503a0cfbaf8f2a5f512499d71cf9826a9ff23d
-
SSDEEP
6144:FFJ0PWeBxEJnyQ+qbj/y/1SrC/MVcjwt6kWlf8lrm:wZEJnyabr4Z/K3t6Jf8lS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
befhihcdef.exepid process 1900 befhihcdef.exe -
Loads dropped DLL 5 IoCs
Processes:
ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exeWerFault.exepid process 1520 ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe 1836 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1836 1900 WerFault.exe befhihcdef.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1636 wmic.exe Token: SeSecurityPrivilege 1636 wmic.exe Token: SeTakeOwnershipPrivilege 1636 wmic.exe Token: SeLoadDriverPrivilege 1636 wmic.exe Token: SeSystemProfilePrivilege 1636 wmic.exe Token: SeSystemtimePrivilege 1636 wmic.exe Token: SeProfSingleProcessPrivilege 1636 wmic.exe Token: SeIncBasePriorityPrivilege 1636 wmic.exe Token: SeCreatePagefilePrivilege 1636 wmic.exe Token: SeBackupPrivilege 1636 wmic.exe Token: SeRestorePrivilege 1636 wmic.exe Token: SeShutdownPrivilege 1636 wmic.exe Token: SeDebugPrivilege 1636 wmic.exe Token: SeSystemEnvironmentPrivilege 1636 wmic.exe Token: SeRemoteShutdownPrivilege 1636 wmic.exe Token: SeUndockPrivilege 1636 wmic.exe Token: SeManageVolumePrivilege 1636 wmic.exe Token: 33 1636 wmic.exe Token: 34 1636 wmic.exe Token: 35 1636 wmic.exe Token: SeIncreaseQuotaPrivilege 1636 wmic.exe Token: SeSecurityPrivilege 1636 wmic.exe Token: SeTakeOwnershipPrivilege 1636 wmic.exe Token: SeLoadDriverPrivilege 1636 wmic.exe Token: SeSystemProfilePrivilege 1636 wmic.exe Token: SeSystemtimePrivilege 1636 wmic.exe Token: SeProfSingleProcessPrivilege 1636 wmic.exe Token: SeIncBasePriorityPrivilege 1636 wmic.exe Token: SeCreatePagefilePrivilege 1636 wmic.exe Token: SeBackupPrivilege 1636 wmic.exe Token: SeRestorePrivilege 1636 wmic.exe Token: SeShutdownPrivilege 1636 wmic.exe Token: SeDebugPrivilege 1636 wmic.exe Token: SeSystemEnvironmentPrivilege 1636 wmic.exe Token: SeRemoteShutdownPrivilege 1636 wmic.exe Token: SeUndockPrivilege 1636 wmic.exe Token: SeManageVolumePrivilege 1636 wmic.exe Token: 33 1636 wmic.exe Token: 34 1636 wmic.exe Token: 35 1636 wmic.exe Token: SeIncreaseQuotaPrivilege 1800 wmic.exe Token: SeSecurityPrivilege 1800 wmic.exe Token: SeTakeOwnershipPrivilege 1800 wmic.exe Token: SeLoadDriverPrivilege 1800 wmic.exe Token: SeSystemProfilePrivilege 1800 wmic.exe Token: SeSystemtimePrivilege 1800 wmic.exe Token: SeProfSingleProcessPrivilege 1800 wmic.exe Token: SeIncBasePriorityPrivilege 1800 wmic.exe Token: SeCreatePagefilePrivilege 1800 wmic.exe Token: SeBackupPrivilege 1800 wmic.exe Token: SeRestorePrivilege 1800 wmic.exe Token: SeShutdownPrivilege 1800 wmic.exe Token: SeDebugPrivilege 1800 wmic.exe Token: SeSystemEnvironmentPrivilege 1800 wmic.exe Token: SeRemoteShutdownPrivilege 1800 wmic.exe Token: SeUndockPrivilege 1800 wmic.exe Token: SeManageVolumePrivilege 1800 wmic.exe Token: 33 1800 wmic.exe Token: 34 1800 wmic.exe Token: 35 1800 wmic.exe Token: SeIncreaseQuotaPrivilege 1800 wmic.exe Token: SeSecurityPrivilege 1800 wmic.exe Token: SeTakeOwnershipPrivilege 1800 wmic.exe Token: SeLoadDriverPrivilege 1800 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exebefhihcdef.exedescription pid process target process PID 1520 wrote to memory of 1900 1520 ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe befhihcdef.exe PID 1520 wrote to memory of 1900 1520 ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe befhihcdef.exe PID 1520 wrote to memory of 1900 1520 ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe befhihcdef.exe PID 1520 wrote to memory of 1900 1520 ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe befhihcdef.exe PID 1900 wrote to memory of 1636 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1636 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1636 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1636 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1800 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1800 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1800 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1800 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1936 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1936 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1936 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1936 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1648 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1648 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1648 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1648 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1992 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1992 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1992 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1992 1900 befhihcdef.exe wmic.exe PID 1900 wrote to memory of 1836 1900 befhihcdef.exe WerFault.exe PID 1900 wrote to memory of 1836 1900 befhihcdef.exe WerFault.exe PID 1900 wrote to memory of 1836 1900 befhihcdef.exe WerFault.exe PID 1900 wrote to memory of 1836 1900 befhihcdef.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe"C:\Users\Admin\AppData\Local\Temp\ad5c639fc1db90c88ef5f5812bf6034ff2be09f184b92b35288af643cb993a24.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\befhihcdef.exeC:\Users\Admin\AppData\Local\Temp\befhihcdef.exe 0]3]9]1]6]5]5]7]3]3]2 L01AQzctLzAuNR4vUExBSkQ/Ni0dLU5CS1ZJTUZCQTouICw7SE1PRD06MC40Ni4fKT5EPTotHi9NSU4+UD5NXEZCPS8wNiw0GyhQQlBWQkleT01HNmVxcnA3Ji5tbXEnQUJRSypLTkooPElNK0dOQ0YfKT5HQkBIR0Q6Fy4+LDgmLh0tRC80LCsbKj0wOisxHSZDLjgoKh0sQjU6JDAaKktLTEFTQ1FWT0xEUTpAVjsgLEdRST9QPFFcQ1VJODwaKktLTEFTQ1FWTTtIQDZvcmxfNVk0MC8bKEJVQ19SSUs3Y29tbTctL2EoNWleLC5jb2h0NC1xKF5naHJhZHJsZXMoaWBtLHBjdHJnXmxwKV51Yh4vQk9EWT5IPUlGTEU6Fy5CSk5NXD9QT1RKREw4MBksUUZBS0JYSVBaTk9JOyAsTUw3LRsoQVAvPR0mUU9JT0JKQl1XQkNCSUhAQko+RUVSSUs3GypCUFxQVUtLSEdAOG1vcmMgLElETlBNR0ZLRV9SSkRMWj86VlA7Mh0mR0M/QFE6Lh4vRkpePlRJOkpGQV9CRUJMVEtNQkE7Zl5jcl8bKj1MVExMTDhDWURLNi8tNi4uKC8oNC4nLi8wICxHQEw8R0VCSV1JS0pTO0dHNnFvc2UdJlNDSEA2LjEzODUoODMtLBksQU1XS0NOOz9aTUZKQz0wJjEuKi0pLjMoMS4xMy81LSonPks=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669706330.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669706330.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669706330.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669706330.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669706330.txt bios get version3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 3723⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\81669706330.txtFilesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
C:\Users\Admin\AppData\Local\Temp\81669706330.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
C:\Users\Admin\AppData\Local\Temp\81669706330.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
C:\Users\Admin\AppData\Local\Temp\81669706330.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
C:\Users\Admin\AppData\Local\Temp\81669706330.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
C:\Users\Admin\AppData\Local\Temp\befhihcdef.exeFilesize
570KB
MD5f45a7056a320f501168db73a938c56a3
SHA114f56e09dfa8ebd7dfcebdc8c838f68127ee74dc
SHA25684b78163a7d770ee85ba3371daaa91e6325e593861e0b7bc57b03fe522a15628
SHA512805a9a8ef3e58f7ceb151a74608afc0bc7303726d99079787f654fdd4b470b6e69af8ae1a8b92feeb4cd81a87a0ad3107a44603685a1dbe9e688b91eb2652c60
-
\Users\Admin\AppData\Local\Temp\befhihcdef.exeFilesize
570KB
MD5f45a7056a320f501168db73a938c56a3
SHA114f56e09dfa8ebd7dfcebdc8c838f68127ee74dc
SHA25684b78163a7d770ee85ba3371daaa91e6325e593861e0b7bc57b03fe522a15628
SHA512805a9a8ef3e58f7ceb151a74608afc0bc7303726d99079787f654fdd4b470b6e69af8ae1a8b92feeb4cd81a87a0ad3107a44603685a1dbe9e688b91eb2652c60
-
\Users\Admin\AppData\Local\Temp\befhihcdef.exeFilesize
570KB
MD5f45a7056a320f501168db73a938c56a3
SHA114f56e09dfa8ebd7dfcebdc8c838f68127ee74dc
SHA25684b78163a7d770ee85ba3371daaa91e6325e593861e0b7bc57b03fe522a15628
SHA512805a9a8ef3e58f7ceb151a74608afc0bc7303726d99079787f654fdd4b470b6e69af8ae1a8b92feeb4cd81a87a0ad3107a44603685a1dbe9e688b91eb2652c60
-
\Users\Admin\AppData\Local\Temp\befhihcdef.exeFilesize
570KB
MD5f45a7056a320f501168db73a938c56a3
SHA114f56e09dfa8ebd7dfcebdc8c838f68127ee74dc
SHA25684b78163a7d770ee85ba3371daaa91e6325e593861e0b7bc57b03fe522a15628
SHA512805a9a8ef3e58f7ceb151a74608afc0bc7303726d99079787f654fdd4b470b6e69af8ae1a8b92feeb4cd81a87a0ad3107a44603685a1dbe9e688b91eb2652c60
-
\Users\Admin\AppData\Local\Temp\befhihcdef.exeFilesize
570KB
MD5f45a7056a320f501168db73a938c56a3
SHA114f56e09dfa8ebd7dfcebdc8c838f68127ee74dc
SHA25684b78163a7d770ee85ba3371daaa91e6325e593861e0b7bc57b03fe522a15628
SHA512805a9a8ef3e58f7ceb151a74608afc0bc7303726d99079787f654fdd4b470b6e69af8ae1a8b92feeb4cd81a87a0ad3107a44603685a1dbe9e688b91eb2652c60
-
\Users\Admin\AppData\Local\Temp\befhihcdef.exeFilesize
570KB
MD5f45a7056a320f501168db73a938c56a3
SHA114f56e09dfa8ebd7dfcebdc8c838f68127ee74dc
SHA25684b78163a7d770ee85ba3371daaa91e6325e593861e0b7bc57b03fe522a15628
SHA512805a9a8ef3e58f7ceb151a74608afc0bc7303726d99079787f654fdd4b470b6e69af8ae1a8b92feeb4cd81a87a0ad3107a44603685a1dbe9e688b91eb2652c60
-
memory/1520-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1636-59-0x0000000000000000-mapping.dmp
-
memory/1648-65-0x0000000000000000-mapping.dmp
-
memory/1800-61-0x0000000000000000-mapping.dmp
-
memory/1836-69-0x0000000000000000-mapping.dmp
-
memory/1900-56-0x0000000000000000-mapping.dmp
-
memory/1936-63-0x0000000000000000-mapping.dmp
-
memory/1992-67-0x0000000000000000-mapping.dmp