Overview

overview

10

Static

static

B23D910F08...B4.exe

windows7_x64

8

B23D910F08...B4.exe

windows10_x64

10

Analysis

  • max time kernel
    137s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07-05-2021 14:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B23D910F08643F0C79F08297AAD168634E6F5A5552EB4.exe

  • Size

    394KB

  • MD5

    f7533c6cdcaf5f39b1656e6d93644639

  • SHA1

    a5720fac0e88fd0c5c717ea5bb9f451f1ef7aa43

  • SHA256

    b23d910f08643f0c79f08297aad168634e6f5a5552eb469f4b7e0bce2b0568b5

  • SHA512

    5fdf0227d08eadd2238e66839c3b5b23d45db7493d9809f3db4ae3cf129a4dae10df1e98c1ebabbb8d48a7003a034bf958fb1fd34bf9f283d30903ffdb6d6e0b

Score
10/10
persistenceupx

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\B23D910F08643F0C79F08297AAD168634E6F5A5552EB4.exe
    "C:\Users\Admin\AppData\Local\Temp\B23D910F08643F0C79F08297AAD168634E6F5A5552EB4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Users\Admin\AppData\Local\Temp\B23D910F08643F0C79F08297AAD168634E6F5A5552EB4.exe
      "C:\Users\Admin\AppData\Local\Temp\B23D910F08643F0C79F08297AAD168634E6F5A5552EB4.exe"
      2⤵
      • Adds policy Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Users\Admin\AppData\Local\Temp\B23D910F08643F0C79F08297AAD168634E6F5A5552EB4.exe
        "C:\Users\Admin\AppData\Local\Temp\B23D910F08643F0C79F08297AAD168634E6F5A5552EB4.exe"
        3⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1408
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2216
        • C:\Windows\msa\wimpr.exe
          "C:\Windows\msa\wimpr.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:3976
          • C:\Windows\msa\wimpr.exe
            "C:\Windows\msa\wimpr.exe"
            5⤵
            • Executes dropped EXE
            PID:800
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 620
              6⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2336
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1524
          4⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
    MD5

    2329955df695945d28ce7f39994959ed

    SHA1

    8d39f0158bc5d0ce56c24c5864327e8860007549

    SHA256

    d6eef09754540671f0afa7a2dca8fa284570daed3b7081959d42aa71affebc4f

    SHA512

    38391aeed6f7da7f13273cfcffd1b7579fe7c3c0f070e42c1f2de5e99ac5a72ceed79d27039868fa4b7649bc35d0e3df0b55a546381f9ab8f4ac7a8aa17d0109

    Download Submit
  • C:\Windows\msa\wimpr.exe
    MD5

    f7533c6cdcaf5f39b1656e6d93644639

    SHA1

    a5720fac0e88fd0c5c717ea5bb9f451f1ef7aa43

    SHA256

    b23d910f08643f0c79f08297aad168634e6f5a5552eb469f4b7e0bce2b0568b5

    SHA512

    5fdf0227d08eadd2238e66839c3b5b23d45db7493d9809f3db4ae3cf129a4dae10df1e98c1ebabbb8d48a7003a034bf958fb1fd34bf9f283d30903ffdb6d6e0b

    Download Submit
  • C:\Windows\msa\wimpr.exe
    MD5

    f7533c6cdcaf5f39b1656e6d93644639

    SHA1

    a5720fac0e88fd0c5c717ea5bb9f451f1ef7aa43

    SHA256

    b23d910f08643f0c79f08297aad168634e6f5a5552eb469f4b7e0bce2b0568b5

    SHA512

    5fdf0227d08eadd2238e66839c3b5b23d45db7493d9809f3db4ae3cf129a4dae10df1e98c1ebabbb8d48a7003a034bf958fb1fd34bf9f283d30903ffdb6d6e0b

    Download Submit
  • C:\Windows\msa\wimpr.exe
    MD5

    f7533c6cdcaf5f39b1656e6d93644639

    SHA1

    a5720fac0e88fd0c5c717ea5bb9f451f1ef7aa43

    SHA256

    b23d910f08643f0c79f08297aad168634e6f5a5552eb469f4b7e0bce2b0568b5

    SHA512

    5fdf0227d08eadd2238e66839c3b5b23d45db7493d9809f3db4ae3cf129a4dae10df1e98c1ebabbb8d48a7003a034bf958fb1fd34bf9f283d30903ffdb6d6e0b

    Download Submit
  • memory/800-166-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/800-164-0x0000000000454FE0-mapping.dmp
    Download
  • memory/804-156-0x0000000010410000-0x0000000010475000-memory.dmp
    Filesize

    404KB

    Download
  • memory/804-121-0x00000000001E0000-0x00000000001E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/804-122-0x0000000000570000-0x0000000000571000-memory.dmp
    Filesize

    4KB

    Download
  • memory/804-120-0x0000000000000000-mapping.dmp
    Download
  • memory/3720-116-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3720-118-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3720-117-0x0000000000454FE0-mapping.dmp
    Download
  • memory/3976-159-0x0000000000000000-mapping.dmp
    Download