Analysis
-
max time kernel
108s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
04/01/2023, 13:10
General
-
Target
WerFault.exe
-
Size
557KB
-
MD5
fd27d9f6d02763bde32511b5df7ff7a0
-
SHA1
ee79105026360209a5466db878e50f84cd6fc0f0
-
SHA256
82e7105bc8decc5d75630ad984c12ba67ebf00109aeae739f4733f1e608b3b88
-
SHA512
4d632b69087119e3303145eb0fa9339eb799596478b659c6f3fcfa35c6586569fe745355ac29bad7028674d8db4cc9549bdc8d5e9bd1b687caff9b5da3cbd3e2
-
SSDEEP
12288:mIyVelsMij33R6TXrP3Fb1M8WbHOzvR7lfc2HywRhXM:mIdAUB1kHOzvR7lfcyh4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WerFault.exe"C:\Users\Admin\AppData\Local\Temp\WerFault.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\file.xls"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
152KB
-
Filesize
1.6MB
-
Filesize
128KB
-
Filesize
540KB
-
Filesize
48KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
176KB
-
Filesize
120KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
24KB
-
Filesize
20KB
-
Filesize
3.4MB
-
Filesize
28KB
-
Filesize
24KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
3.4MB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
24KB
-
Filesize
40KB
-
Filesize
24KB
-
Filesize
32KB
-
Filesize
20KB
-
Filesize
24KB
-
Filesize
416KB
-
Filesize
100KB
-
Filesize
64KB
-
Filesize
2.6MB
-
Filesize
628KB
-
Filesize
5.4MB
-
Filesize
628KB
-
Filesize
2.6MB
-
Filesize
3.4MB
-
Filesize
128KB
-
Filesize
60KB
-
Filesize
176KB
-
Filesize
5.4MB
-
Filesize
540KB
-
Filesize
2.6MB
-
Filesize
628KB