dc5dbaec79a2b312d245de8e05efd500010a30279fbf4d1697cf5a5ee3a34373

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc5dbaec79a2b312d245de8e05efd500010a30279fbf4d1697cf5a5ee3a34373.exe
Size

2.0MB
MD5

8805c3027147835dad7825301e5c4f80
SHA1

953e1d83a216934c65257a0fc8a2561c7cf29e52
SHA256

dc5dbaec79a2b312d245de8e05efd500010a30279fbf4d1697cf5a5ee3a34373
SHA512

9f1c6102310485fb9ffa3a1da6997cb49b171134837d04631af77f70e2aa800d9beb71de52df7c3a3406eb85ac49065fc53dd3ad5a3303e7ff033ba0bafade86
SSDEEP

49152:hEdvDkYZ12B41MJsHKfOGzAIxve4DhNsBniKpfKynky0lu:hEZDkTNOyOGzAIxW44Bbncu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5032	4832	WerFault.exe	79
1372	4832	WerFault.exe	79
764	4832	WerFault.exe	79
228	4832	WerFault.exe	79
1776	4832	WerFault.exe	79
484	4832	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4832	dc5dbaec79a2b312d245de8e05efd500010a30279fbf4d1697cf5a5ee3a34373.exe

C:\Users\Admin\AppData\Local\Temp\dc5dbaec79a2b312d245de8e05efd500010a30279fbf4d1697cf5a5ee3a34373.exe
"C:\Users\Admin\AppData\Local\Temp\dc5dbaec79a2b312d245de8e05efd500010a30279fbf4d1697cf5a5ee3a34373.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 736
  2⤵
  - Program crash
  PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 804
  2⤵
  - Program crash
  PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 848
  2⤵
  - Program crash
  PID:764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 1380
  2⤵
  - Program crash
  PID:228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 1404
  2⤵
  - Program crash
  PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 1412
  2⤵
  - Program crash
  PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4832 -ip 4832
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4832 -ip 4832
1⤵
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4832 -ip 4832
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4832 -ip 4832
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4832 -ip 4832
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4832 -ip 4832
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-132-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/4832-133-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download