Analysis

  • max time kernel
    119s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    09-05-2021 21:29

General

  • Target

    a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe

  • Size

    834KB

  • MD5

    63d23949144c09b33cd549e2fbd692da

  • SHA1

    c2090ce4c360783151a34b89fe6c17470a73bf21

  • SHA256

    a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d

  • SHA512

    c4735fef33fc054ffd73ffed9df93893dda125229cc17cfcbf1cd968abf6e3a7746f2c9752d4c5b971824627b950907a2916cf9d20839a03ea0a7545ee20f5c1

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe
    "C:\Users\Admin\AppData\Local\Temp\a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1984
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:532

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe
    MD5

    d1be37912cb77d7c99b6eedcc490c274

    SHA1

    969f26b526b8d961581710f51991601cc3506e71

    SHA256

    7af850627b2fc57ea8302d1606785d2c29f693e558fe6be5f51326e51434e412

    SHA512

    a4b06c9a669ce7cf0804669be3af504323aeffe1914d4d2b22994d1bf37b41c579ec575bda57bf28fbbe7818aeb26d8786b520e2e8d2231dcc2585f7c35c26e4

  • C:\Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe
    MD5

    df8fd99187d89cbfb5c30766cf37ffe5

    SHA1

    32405616f7c291b44b844b4ccbd3667cc596a622

    SHA256

    d70a79d4bbb7d32cc4e71f7bd245faaa46581fa2fcd5724fd96a9ad171c9e3cb

    SHA512

    e510d2483d2e1b7db73e0cc8a46cb321a75a9ba94a964feaaebc485ae1729e8d1c911ff4d3618f54ecf8104548fbd9be3ba4e2e1aedd6fcfca4c89cde7758cf9

  • \ProgramData\Synaptics\Synaptics.exe
    MD5

    d1be37912cb77d7c99b6eedcc490c274

    SHA1

    969f26b526b8d961581710f51991601cc3506e71

    SHA256

    7af850627b2fc57ea8302d1606785d2c29f693e558fe6be5f51326e51434e412

    SHA512

    a4b06c9a669ce7cf0804669be3af504323aeffe1914d4d2b22994d1bf37b41c579ec575bda57bf28fbbe7818aeb26d8786b520e2e8d2231dcc2585f7c35c26e4

  • \ProgramData\Synaptics\Synaptics.exe
    MD5

    d1be37912cb77d7c99b6eedcc490c274

    SHA1

    969f26b526b8d961581710f51991601cc3506e71

    SHA256

    7af850627b2fc57ea8302d1606785d2c29f693e558fe6be5f51326e51434e412

    SHA512

    a4b06c9a669ce7cf0804669be3af504323aeffe1914d4d2b22994d1bf37b41c579ec575bda57bf28fbbe7818aeb26d8786b520e2e8d2231dcc2585f7c35c26e4

  • \Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe
    MD5

    df8fd99187d89cbfb5c30766cf37ffe5

    SHA1

    32405616f7c291b44b844b4ccbd3667cc596a622

    SHA256

    d70a79d4bbb7d32cc4e71f7bd245faaa46581fa2fcd5724fd96a9ad171c9e3cb

    SHA512

    e510d2483d2e1b7db73e0cc8a46cb321a75a9ba94a964feaaebc485ae1729e8d1c911ff4d3618f54ecf8104548fbd9be3ba4e2e1aedd6fcfca4c89cde7758cf9

  • \Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe
    MD5

    df8fd99187d89cbfb5c30766cf37ffe5

    SHA1

    32405616f7c291b44b844b4ccbd3667cc596a622

    SHA256

    d70a79d4bbb7d32cc4e71f7bd245faaa46581fa2fcd5724fd96a9ad171c9e3cb

    SHA512

    e510d2483d2e1b7db73e0cc8a46cb321a75a9ba94a964feaaebc485ae1729e8d1c911ff4d3618f54ecf8104548fbd9be3ba4e2e1aedd6fcfca4c89cde7758cf9

  • memory/532-70-0x0000000000000000-mapping.dmp
  • memory/532-73-0x0000000000220000-0x0000000000221000-memory.dmp
    Filesize

    4KB

  • memory/980-60-0x0000000075FF1000-0x0000000075FF3000-memory.dmp
    Filesize

    8KB

  • memory/980-61-0x0000000000220000-0x0000000000221000-memory.dmp
    Filesize

    4KB

  • memory/1984-64-0x0000000000000000-mapping.dmp