Resubmissions
28-08-2020 12:47
200828-nd915gcv5n 828-08-2020 12:45
200828-q7w77zyk92 828-08-2020 12:39
200828-h3kmc18276 8Analysis
-
max time kernel
138s -
max time network
67s -
platform
windows7_x64 -
resource
win7 -
submitted
28-08-2020 12:39
Static task
static1
Behavioral task
behavioral1
Sample
myfile.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
myfile.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
myfile.exe
-
Size
4.3MB
-
MD5
0a438448cebd370318b5294775e2405c
-
SHA1
60abd37bf94ee406653af60e5b72f1f69f646308
-
SHA256
1e40bce6e476e4c0485b3f813cff5d493b1e07f52a89b56a31765529b809ea33
-
SHA512
dc21a068d6aa3ce93a399d2b636a4dc17fd9b2f60c921eaadaef4eb0049c4ef5d1c09479c906660d0fa7bb7e688cdae54a36d9e73e35ac209e469a862c992976
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
HexInformation.exeHexDecryptor.exeHexLocker.exepid process 1908 HexInformation.exe 1912 HexDecryptor.exe 1768 HexLocker.exe -
Enumerates connected drives 3 TTPs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
HexLocker.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wl.jpg" HexLocker.exe -
Modifies Control Panel 1 IoCs
Processes:
HexLocker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop HexLocker.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs
Processes:
HexInformation.exeHexDecryptor.exeHexLocker.exepid process 1908 HexInformation.exe 1912 HexDecryptor.exe 1768 HexLocker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
HexInformation.exepid process 1908 HexInformation.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
myfile.execmd.exeHexDecryptor.exedescription pid process target process PID 1584 wrote to memory of 1804 1584 myfile.exe cmd.exe PID 1584 wrote to memory of 1804 1584 myfile.exe cmd.exe PID 1584 wrote to memory of 1804 1584 myfile.exe cmd.exe PID 1584 wrote to memory of 1804 1584 myfile.exe cmd.exe PID 1804 wrote to memory of 1836 1804 cmd.exe tree.com PID 1804 wrote to memory of 1836 1804 cmd.exe tree.com PID 1804 wrote to memory of 1836 1804 cmd.exe tree.com PID 1804 wrote to memory of 1844 1804 cmd.exe tree.com PID 1804 wrote to memory of 1844 1804 cmd.exe tree.com PID 1804 wrote to memory of 1844 1804 cmd.exe tree.com PID 1804 wrote to memory of 1856 1804 cmd.exe tree.com PID 1804 wrote to memory of 1856 1804 cmd.exe tree.com PID 1804 wrote to memory of 1856 1804 cmd.exe tree.com PID 1804 wrote to memory of 1868 1804 cmd.exe tree.com PID 1804 wrote to memory of 1868 1804 cmd.exe tree.com PID 1804 wrote to memory of 1868 1804 cmd.exe tree.com PID 1804 wrote to memory of 1896 1804 cmd.exe tree.com PID 1804 wrote to memory of 1896 1804 cmd.exe tree.com PID 1804 wrote to memory of 1896 1804 cmd.exe tree.com PID 1804 wrote to memory of 1908 1804 cmd.exe HexInformation.exe PID 1804 wrote to memory of 1908 1804 cmd.exe HexInformation.exe PID 1804 wrote to memory of 1908 1804 cmd.exe HexInformation.exe PID 1804 wrote to memory of 1908 1804 cmd.exe HexInformation.exe PID 1804 wrote to memory of 1912 1804 cmd.exe HexDecryptor.exe PID 1804 wrote to memory of 1912 1804 cmd.exe HexDecryptor.exe PID 1804 wrote to memory of 1912 1804 cmd.exe HexDecryptor.exe PID 1804 wrote to memory of 1912 1804 cmd.exe HexDecryptor.exe PID 1804 wrote to memory of 1768 1804 cmd.exe HexLocker.exe PID 1804 wrote to memory of 1768 1804 cmd.exe HexLocker.exe PID 1804 wrote to memory of 1768 1804 cmd.exe HexLocker.exe PID 1804 wrote to memory of 1768 1804 cmd.exe HexLocker.exe PID 1912 wrote to memory of 1964 1912 HexDecryptor.exe cmd.exe PID 1912 wrote to memory of 1964 1912 HexDecryptor.exe cmd.exe PID 1912 wrote to memory of 1964 1912 HexDecryptor.exe cmd.exe PID 1912 wrote to memory of 1964 1912 HexDecryptor.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\myfile.exe"C:\Users\Admin\AppData\Local\Temp\myfile.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\363D.tmp\363E.tmp\364E.bat C:\Users\Admin\AppData\Local\Temp\myfile.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tree.comtree3⤵
-
C:\Windows\system32\tree.comtree3⤵
-
C:\Windows\system32\tree.comtree3⤵
-
C:\Windows\system32\tree.comtree3⤵
-
C:\Windows\system32\tree.comtree3⤵
-
C:\Users\Admin\Desktop\HexInformation.exeHexInformation.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\HexDecryptor.exeHexDecryptor.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\39E5.tmp\39E6.tmp\39E7.bat C:\Users\Admin\Desktop\HexDecryptor.exe"4⤵
-
C:\Users\Admin\Desktop\HexLocker.exeHexLocker.exe3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: CmdExeWriteProcessMemorySpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp\363E.tmp\364E.bat
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp\39E6.tmp\39E7.bat
-
C:\Users\Admin\AppData\Local\Temp\HexDCIF.hex
-
C:\Users\Admin\AppData\Local\Temp\HexIF.hex
-
C:\Users\Admin\AppData\Local\Temp\HexLK.hex
-
C:\Users\Admin\AppData\Local\Temp\rd000db.dll
-
C:\Users\Admin\Desktop\HexDecryptor.exe
-
C:\Users\Admin\Desktop\HexDecryptor.exe
-
C:\Users\Admin\Desktop\HexInformation.exe
-
C:\Users\Admin\Desktop\HexInformation.exe
-
C:\Users\Admin\Desktop\HexLocker.exe
-
C:\Users\Admin\Desktop\HexLocker.exe
-
memory/1768-18-0x0000000000000000-mapping.dmp
-
memory/1768-19-0x0000000000000000-mapping.dmp
-
memory/1796-28-0x000007FEF68A0000-0x000007FEF6B1A000-memory.dmpFilesize
2.5MB
-
memory/1804-0-0x0000000000000000-mapping.dmp
-
memory/1836-2-0x0000000000000000-mapping.dmp
-
memory/1844-3-0x0000000000000000-mapping.dmp
-
memory/1856-4-0x0000000000000000-mapping.dmp
-
memory/1868-5-0x0000000000000000-mapping.dmp
-
memory/1896-6-0x0000000000000000-mapping.dmp
-
memory/1908-12-0x0000000000000000-mapping.dmp
-
memory/1908-11-0x0000000000000000-mapping.dmp
-
memory/1908-21-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/1908-26-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/1912-14-0x0000000000000000-mapping.dmp
-
memory/1912-15-0x0000000000000000-mapping.dmp
-
memory/1964-22-0x0000000000000000-mapping.dmp