7633b4acaf0a9b58ceb77197cd65aa1279b0eb0b47c503b263a0da486019f717

Analysis

max time kernel
148s
max time network
204s
platform
windows7_x64
resource
win7v20210408
submitted
29/05/2021, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a51a47dc9871c874291574368331ed76.exe
Size 868KB
Sample210529-fehf2sv4da
SHA256 7633b4acaf0a9b58ceb77197cd65aa1279b0eb0b47c503b263a0da486019f717
MD5 a51a47dc9871c874291574368331ed76
SHA1 312da86edc860c2779a77e2f3dfce70e3d4d8704
SHA512 d55441fc80e12006c718f6842ebb2ba1db2de23ff9a8a0be9d4093e8d4cf91b85a3650b44be906c5f94d5019e7802337bcd1d01eb646dee0cea04b021ed9b097
MD5 SHA1 SHA512

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
340	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8449fa22-2718-41be-ba5e-4d22186df2ab\\a51a47dc9871c874291574368331ed76.exe\" --AutoStart"	a51a47dc9871c874291574368331ed76.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.2ip.ua
7	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 332 set thread context of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 436 set thread context of 1088	436	a51a47dc9871c874291574368331ed76.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1764	a51a47dc9871c874291574368331ed76.exe
1764	a51a47dc9871c874291574368331ed76.exe
1088	a51a47dc9871c874291574368331ed76.exe
1088	a51a47dc9871c874291574368331ed76.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 332 wrote to memory of 1764	332	a51a47dc9871c874291574368331ed76.exe	29
PID 1764 wrote to memory of 340	1764	a51a47dc9871c874291574368331ed76.exe	32
PID 1764 wrote to memory of 340	1764	a51a47dc9871c874291574368331ed76.exe	32
PID 1764 wrote to memory of 340	1764	a51a47dc9871c874291574368331ed76.exe	32
PID 1764 wrote to memory of 340	1764	a51a47dc9871c874291574368331ed76.exe	32
PID 1764 wrote to memory of 436	1764	a51a47dc9871c874291574368331ed76.exe	33
PID 1764 wrote to memory of 436	1764	a51a47dc9871c874291574368331ed76.exe	33
PID 1764 wrote to memory of 436	1764	a51a47dc9871c874291574368331ed76.exe	33
PID 1764 wrote to memory of 436	1764	a51a47dc9871c874291574368331ed76.exe	33
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34
PID 436 wrote to memory of 1088	436	a51a47dc9871c874291574368331ed76.exe	34

C:\Users\Admin\AppData\Local\Temp\a51a47dc9871c874291574368331ed76.exe
"C:\Users\Admin\AppData\Local\Temp\a51a47dc9871c874291574368331ed76.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:332
- C:\Users\Admin\AppData\Local\Temp\a51a47dc9871c874291574368331ed76.exe
  "C:\Users\Admin\AppData\Local\Temp\a51a47dc9871c874291574368331ed76.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\8449fa22-2718-41be-ba5e-4d22186df2ab" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\a51a47dc9871c874291574368331ed76.exe
    "C:\Users\Admin\AppData\Local\Temp\a51a47dc9871c874291574368331ed76.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\a51a47dc9871c874291574368331ed76.exe
      "C:\Users\Admin\AppData\Local\Temp\a51a47dc9871c874291574368331ed76.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-62-0x0000000001DE0000-0x0000000001EFB000-memory.dmp

Download

memory/1088-71-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1764-59-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1764-61-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Download

memory/1764-63-0x0000000000400000-0x0000000000537000-memory.dmp

Download