d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792

General

Target

d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe
Size

124KB
MD5

e09fac9877914b5e4b6e1fb0be54a668
SHA1

0eb6f198d25efb6f89d0c659044dec5bfe6085f4
SHA256

d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792
SHA512

b92f0f88187824324d5e48066a873b685f67506eadd6bbb4d07b9e8120206d7df88ee63fd50463171ceba80fc7ab7985e99973c0bc4b13a3deed6bf9febb9341
SSDEEP

3072:lcvW8TWNkbjAmcVKwH3AX4Ymbm4fjtYqTvT:lcvtTWCwHcEFaqT7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1176 1260 WerFault.exe d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe

pid process

1260 d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe

pid	pid_target	process	target process
1176	1260	WerFault.exe	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe

pid	process
1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe

description	pid	process	target process
PID 1260 wrote to memory of 1324	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1324	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1324	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1324	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 2012	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 2012	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 2012	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 2012	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 928	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 928	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 928	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 928	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 584	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 584	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 584	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 584	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 268	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 268	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 268	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 268	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1640	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1640	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1640	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1640	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 692	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 692	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 692	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 692	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1884	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1884	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1884	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1884	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 292	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 292	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 292	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 292	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 272	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 272	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 272	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 272	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1008	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1008	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1008	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1008	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 548	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 548	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 548	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 548	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 396	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 396	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 396	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 396	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 652	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 652	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 652	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 652	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	cmd.exe
PID 1260 wrote to memory of 1176	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	WerFault.exe
PID 1260 wrote to memory of 1176	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	WerFault.exe
PID 1260 wrote to memory of 1176	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	WerFault.exe
PID 1260 wrote to memory of 1176	1260	d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe
"C:\Users\Admin\AppData\Local\Temp\d42ab4f3b55213d18e29a17e6a34c9b4beee1dbeae92fe5f8051276e68743792.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:1324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:928

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:1884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:292

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:272

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:1008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:396

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 260
2⤵
- Program crash
PID:1176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads