Analysis
-
max time kernel
76s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
14/05/2021, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
66D7C25E25D943FF9972AD4E2821A586.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
66D7C25E25D943FF9972AD4E2821A586.exe
-
Size
1.9MB
-
MD5
66d7c25e25d943ff9972ad4e2821a586
-
SHA1
1c2f71afa6f6e13dd5939f4cad875aad33902627
-
SHA256
41f2e8b68fe406f818f0ab48067d967cc0a3430a9ddb97a191b3fca163b756ab
-
SHA512
18d40773115c4bf9a80c1b91c04b0a58eeb69f8c9b25da68dcfcb92e3d532ba09d2aa6a278d6e0891e19e3e572ba1c77efe422189bd9b752ce770609904ac76f
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 852 Ove.exe.com 540 Ove.exe.com -
Loads dropped DLL 2 IoCs
pid Process 308 cmd.exe 852 Ove.exe.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Ove.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Ove.exe.com -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1540 PING.EXE -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 480 wrote to memory of 1980 480 66D7C25E25D943FF9972AD4E2821A586.exe 26 PID 480 wrote to memory of 1980 480 66D7C25E25D943FF9972AD4E2821A586.exe 26 PID 480 wrote to memory of 1980 480 66D7C25E25D943FF9972AD4E2821A586.exe 26 PID 480 wrote to memory of 1980 480 66D7C25E25D943FF9972AD4E2821A586.exe 26 PID 480 wrote to memory of 1908 480 66D7C25E25D943FF9972AD4E2821A586.exe 28 PID 480 wrote to memory of 1908 480 66D7C25E25D943FF9972AD4E2821A586.exe 28 PID 480 wrote to memory of 1908 480 66D7C25E25D943FF9972AD4E2821A586.exe 28 PID 480 wrote to memory of 1908 480 66D7C25E25D943FF9972AD4E2821A586.exe 28 PID 480 wrote to memory of 1764 480 66D7C25E25D943FF9972AD4E2821A586.exe 30 PID 480 wrote to memory of 1764 480 66D7C25E25D943FF9972AD4E2821A586.exe 30 PID 480 wrote to memory of 1764 480 66D7C25E25D943FF9972AD4E2821A586.exe 30 PID 480 wrote to memory of 1764 480 66D7C25E25D943FF9972AD4E2821A586.exe 30 PID 480 wrote to memory of 1740 480 66D7C25E25D943FF9972AD4E2821A586.exe 32 PID 480 wrote to memory of 1740 480 66D7C25E25D943FF9972AD4E2821A586.exe 32 PID 480 wrote to memory of 1740 480 66D7C25E25D943FF9972AD4E2821A586.exe 32 PID 480 wrote to memory of 1740 480 66D7C25E25D943FF9972AD4E2821A586.exe 32 PID 480 wrote to memory of 1148 480 66D7C25E25D943FF9972AD4E2821A586.exe 34 PID 480 wrote to memory of 1148 480 66D7C25E25D943FF9972AD4E2821A586.exe 34 PID 480 wrote to memory of 1148 480 66D7C25E25D943FF9972AD4E2821A586.exe 34 PID 480 wrote to memory of 1148 480 66D7C25E25D943FF9972AD4E2821A586.exe 34 PID 480 wrote to memory of 812 480 66D7C25E25D943FF9972AD4E2821A586.exe 36 PID 480 wrote to memory of 812 480 66D7C25E25D943FF9972AD4E2821A586.exe 36 PID 480 wrote to memory of 812 480 66D7C25E25D943FF9972AD4E2821A586.exe 36 PID 480 wrote to memory of 812 480 66D7C25E25D943FF9972AD4E2821A586.exe 36 PID 480 wrote to memory of 1420 480 66D7C25E25D943FF9972AD4E2821A586.exe 38 PID 480 wrote to memory of 1420 480 66D7C25E25D943FF9972AD4E2821A586.exe 38 PID 480 wrote to memory of 1420 480 66D7C25E25D943FF9972AD4E2821A586.exe 38 PID 480 wrote to memory of 1420 480 66D7C25E25D943FF9972AD4E2821A586.exe 38 PID 1420 wrote to memory of 308 1420 cmd.exe 40 PID 1420 wrote to memory of 308 1420 cmd.exe 40 PID 1420 wrote to memory of 308 1420 cmd.exe 40 PID 1420 wrote to memory of 308 1420 cmd.exe 40 PID 308 wrote to memory of 676 308 cmd.exe 41 PID 308 wrote to memory of 676 308 cmd.exe 41 PID 308 wrote to memory of 676 308 cmd.exe 41 PID 308 wrote to memory of 676 308 cmd.exe 41 PID 308 wrote to memory of 852 308 cmd.exe 43 PID 308 wrote to memory of 852 308 cmd.exe 43 PID 308 wrote to memory of 852 308 cmd.exe 43 PID 308 wrote to memory of 852 308 cmd.exe 43 PID 308 wrote to memory of 1540 308 cmd.exe 44 PID 308 wrote to memory of 1540 308 cmd.exe 44 PID 308 wrote to memory of 1540 308 cmd.exe 44 PID 308 wrote to memory of 1540 308 cmd.exe 44 PID 852 wrote to memory of 540 852 Ove.exe.com 45 PID 852 wrote to memory of 540 852 Ove.exe.com 45 PID 852 wrote to memory of 540 852 Ove.exe.com 45 PID 852 wrote to memory of 540 852 Ove.exe.com 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\66D7C25E25D943FF9972AD4E2821A586.exe"C:\Users\Admin\AppData\Local\Temp\66D7C25E25D943FF9972AD4E2821A586.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c IDrlwJfYJMXmiwvMLejGiwpEbzAYBNQCCBNmtKWnUyoSIhlcKugZfCLGzmNHpdbWWxXGgWHqyOLwSsWpoyhxmQjZPuuFXggDIjVhdDuOnhTBQJNeCEmtrebuoXQoQeeRmiz2⤵PID:1980
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cJSEYmWkWKpyarezPlAGPOtzNYXvleeIdiGTLUuDuklbOKPNZJefHMQGEmRZBmqUIAPkvpHUtXADEHEeplvBZMwDdZgjeuwGk2⤵PID:1908
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c PhVEdQeikKjheXUPQsrmUVmkUvUcSXVTagSsuFUGnRBssrXsshdK2⤵PID:1764
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c LcTNKJTWHfhOaVNyDIlvbqezoURnCrEGldGTYDvVqJRCgCYoljOEygyLamFQRczDKHEegTuZkfvNoAyFVJgfgZBW2⤵PID:1740
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c UAnYGtFfgRHYVTsuOzQRaCSxZUiirgLuHRzaHwF2⤵PID:1148
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c QbUJnHqQWpAGKtSaItYMWnjZuBdtmYnNNFqVIpV2⤵PID:812
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rhCXAMlbIpgvnaQrwtQfFzGEIidtAfAdlUEGulyjCLneKrEtxoszjcVJHXfavyXzJYkEOlWQYEMUVDUECkJa & irPYUYpUNPbOyzMRqdlkAcHIwOrrLQkcEcBUvFUkNWlPfyPpoMBVmuvMcuXuUuoWDwpKSRxxvYnElSzVYUUYgdVnYPndINdHNgkhVyddaimBISBDNwiqklIjuLLrztMIHRQWHyqTDEGiRxP & hVCGGdvDGYipzhXhxQTRwFVHwhvG & AcMWEPbBywscjdIYQAfGzMqAYyHZVFzTPqyDxhObmLfOCcOfhJkNiZlOxjXmonGAIbFjlyDCLRiHbjXCdsMjzGMPQ & oodffqtPytQBtiyIwfSCsogxoQMxueLQvUWcjcCuCIuSMOjEuLEvWhZ & TVungKIrzZyl & KvFMLZJwvIzEihcngToUVBsfrRSZrmNJwzvfYKk & dYbjNUivhEtyWdfotdJTiJYXVKCNQyAEIUEWttCpKcLnxHNL & glHqsuGqmseazGitmbwLat & OApLYmCgWQJCVSDsNYWENmQsPExUlLqMllSAicIAXruCKrjkWyhMcmjfJSWzyHrlPWaKZepadcHKahGMsoYtnhdKYCRfngcfZVMNKCkTVVvqSBXckleWJZMBGILbkTTeqsKbBSwPWypCRdSvFctgk & FqokieQOHwwzqARmUaphqDPpJfQfRQPFQBLKgfLYYobiBbdsFyALyYnelZBRjBXRjvDnOukEHlgS & IIjZnJLftmRrJAgOTMblGVtUR & mUWtVKGWBdfSORjCoWLctGWQObRHmNDaiUlRzqEivNYYnqYFYtNiovnSXyfbSYvONXKTHcpoaEYdHYsNmjJxqcpLv & ThKugndplBdyXDVFPDnolYNCYGfeOsNYbfBVbjfAZnNQvxgumcGGjhuVA & oIogcTOsHIwqiDgYoMlWyEapCaKiLppG & frGsLeUetMGtmhrsgyzKDeDdYMeoHFnncFSmHGbKdUqSMyryHPbrPWQjAdaYZLxnh & JTcDKIIJzJeLDTIXBRocJmOFZdhnL & mBEEcpJryOxuCilOMndwlDfSbltQEzxlXPpAiYbngbMzqCWHckDOoJxWkMikyTmLxloNYKGNqRNNQWRUhbxzPFwgcjgx & jzxYwZPxpILEPOdVGufUjYInyVPpTaMcjWObaOPWeArOJPqRKaOyYmFhLWSypGARWfsTZTDSdaSLVTOdVXnBDGbMdBMcWKMcZkSxbuSRPWPFHTsRiCpjoZgfRFDbuiW & FvMKwxSPyGLHRRybpUgzAAhqXCCRDxLHqoZliHQNJxuChGnqAuhkTCuypLMmRqkLVrHISUfBtAJyxLMsrCsbumObeUqcVdVIo & GpYQiFQMiaSqKnYccfJOEcfpGXUTGNFwWZtDahxMGxsvEwlCbmUGZxQkUOplLWyzMR & KxcroUXiprSFFNaviSZwC & C:\Windows\system32\cmd < Naufrago.vssm2⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^MPJomTHJarWYKrSxnHIhGEIlXeqEtUnnpLOyyJXoCUxrBcBNOGmEhseoimkvSrFbFbPYfMgPJmLMpEIBBjPbcUkSJFYFbBdngXbrGCnesKUNGdZCQKVFhieLkWfJNIs$" Vedi.vssm4⤵PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.comOve.exe.com U4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com U5⤵
- Executes dropped EXE
- Checks processor information in registry
PID:540
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:1540
-
-
-