Overview
overview
10Static
static
7samples3.zip
windows7-x64
1samples3.zip
windows10-2004-x64
105cf6eee9b...b3.exe
windows7-x64
105cf6eee9b...b3.exe
windows10-2004-x64
10d332c0478...a7.exe
windows7-x64
90d332c0478...a7.exe
windows10-2004-x64
90fd8500fde...1e.exe
windows7-x64
10fd8500fde...1e.exe
windows10-2004-x64
111edf9436a...ed.pdf
windows7-x64
111edf9436a...ed.pdf
windows10-2004-x64
119a640415b...5c.exe
windows7-x64
1019a640415b...5c.exe
windows10-2004-x64
1033aa57b04b...cb.exe
windows7-x64
633aa57b04b...cb.exe
windows10-2004-x64
63643464a22...19.exe
windows7-x64
33643464a22...19.exe
windows10-2004-x64
337e2f97755...26.exe
windows7-x64
137e2f97755...26.exe
windows10-2004-x64
154cd11236f...ff.exe
windows7-x64
654cd11236f...ff.exe
windows10-2004-x64
655bc661ad4...8c.exe
windows7-x64
955bc661ad4...8c.exe
windows10-2004-x64
7603d665f09...68.exe
windows7-x64
1603d665f09...68.exe
windows10-2004-x64
16ea27a0861...7e.exe
windows7-x64
16ea27a0861...7e.exe
windows10-2004-x64
373af283fcb...0c.exe
windows7-x64
873af283fcb...0c.exe
windows10-2004-x64
87e41197b74...67.exe
windows7-x64
97e41197b74...67.exe
windows10-2004-x64
9a878fed055...99.exe
windows7-x64
3a878fed055...99.exe
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 15:27
Behavioral task
behavioral1
Sample
samples3.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
samples3.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
05cf6eee9b0b2c049cec8ce775de0636ade55f23a51dc833170f09445719abb3.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
05cf6eee9b0b2c049cec8ce775de0636ade55f23a51dc833170f09445719abb3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
0fd8500fdef116abae01a1dcfed2db9784bbcb753488710aa1048f2aa0fd111e.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
0fd8500fdef116abae01a1dcfed2db9784bbcb753488710aa1048f2aa0fd111e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
11edf9436a9205c88c2a815cf6ebfb0a7a42eb150a2649766b3bb30350ee35ed.pdf
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
11edf9436a9205c88c2a815cf6ebfb0a7a42eb150a2649766b3bb30350ee35ed.pdf
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
37e2f977559a58cb33f7128ad7699a5c4f7c0013d8d83b1eda93a59ae35ba526.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
37e2f977559a58cb33f7128ad7699a5c4f7c0013d8d83b1eda93a59ae35ba526.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
54cd11236fdc2a40b505598541f64e8a6bd9ea84552b6d5946777badf8a2b7ff.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
54cd11236fdc2a40b505598541f64e8a6bd9ea84552b6d5946777badf8a2b7ff.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
73af283fcb06a9ea35ea6ad24b62b302459594f4b09dbba2d74001bf90ab020c.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
73af283fcb06a9ea35ea6ad24b62b302459594f4b09dbba2d74001bf90ab020c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe
Resource
win10v2004-20231222-en
General
-
Target
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe
-
Size
63KB
-
MD5
8631a8f38c49a008fa27a1206378e144
-
SHA1
b13d05d99b91fdff5802660218d26c4811e062a0
-
SHA256
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c
-
SHA512
989e642115b8453e5b806e70914243f728d38d29493cb75b49981dd390ad155502b2998bb435ec8f9e88ef0a4ca8921fd7a54f5685c4aef5167ee1a0ea16dee0
-
SSDEEP
768:FWSro9/JJCAaXRCZ+W8UVVMKccxkujVuIbRr4R9FF2GRz:4SE/Db0a+8BccxcIbV4zxz
Malware Config
Signatures
-
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Loads dropped DLL 5 IoCs
Processes:
WerFault.exepid process 2560 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2560 2124 WerFault.exe 55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exedescription pid process Token: SeDebugPrivilege 2124 55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exedescription pid process target process PID 2124 wrote to memory of 2560 2124 55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe WerFault.exe PID 2124 wrote to memory of 2560 2124 55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe WerFault.exe PID 2124 wrote to memory of 2560 2124 55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe WerFault.exe PID 2124 wrote to memory of 2560 2124 55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe"C:\Users\Admin\AppData\Local\Temp\55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 16002⤵
- Loads dropped DLL
- Program crash
PID:2560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CabA4D9.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarA52A.tmpFilesize
24KB
MD53973164abf630939a1935910abe543d8
SHA1dc535294fb54c81b46a3c886d4a56d2a52c110b0
SHA25650e12993ec8ff2547c6c67a60051dba142937e46966e249919ff26b55f59eef9
SHA512081e358d65b0439f9817cf1d59b90f45859b788aa18f829f11d3727643a37ea4fc6d587e4ad0a01b2b7917122dc235c7a582147d4ba9a6d86b982fa536982279
-
C:\Users\Admin\Desktop\UnlockYourFiles4.txtFilesize
301B
MD5f9229fd9d3acdd20bcc4e3cda98e09d0
SHA1f6f04d9379762be5bf3fd9a542fb25b2c9542aea
SHA2569df2c26122c75d33570c827ad0a3d00f1d424278d2513ca5c3aaf8d8c85f5935
SHA512a662f0a0b1ec68cc03eea68c069422c341ab61a8c4d2a4badbb12a0f9161e8c1dca45deeed4014affa2c6fdb64674d40b8ffd945375c6dfdfe7db234c30b7014
-
\Users\Admin\AppData\Local\Temp\55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exeFilesize
63KB
MD58631a8f38c49a008fa27a1206378e144
SHA1b13d05d99b91fdff5802660218d26c4811e062a0
SHA25655bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c
SHA512989e642115b8453e5b806e70914243f728d38d29493cb75b49981dd390ad155502b2998bb435ec8f9e88ef0a4ca8921fd7a54f5685c4aef5167ee1a0ea16dee0
-
memory/2124-0-0x00000000000C0000-0x00000000000D8000-memory.dmpFilesize
96KB
-
memory/2124-1-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/2124-2-0x0000000004E20000-0x0000000004E60000-memory.dmpFilesize
256KB
-
memory/2124-414-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/2124-415-0x0000000004E20000-0x0000000004E60000-memory.dmpFilesize
256KB