Analysis
-
max time kernel
16s -
max time network
39s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-06-2021 20:14
Static task
static1
Behavioral task
behavioral1
Sample
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe
Resource
win10v20210410
General
-
Target
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe
-
Size
3.1MB
-
MD5
52bbd67fdb23378f2ad43efb150abdc4
-
SHA1
9d138f1bf129473cb0d74c0d94ec8af2daa311c7
-
SHA256
22f93b97e4ee74c1af48cbdcf878a983cbe2fba7eefc5cd639814dc942cbaa8d
-
SHA512
7cf115c532466de78abd369ba202f738a3520f7c2b87c4847a8d8e59dc6e2c0d7cd9da1995d019690edd92b3ed154a9d659b7a6932c091e9c042192a66049755
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
Setup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" Setup.exe -
Executes dropped EXE 1 IoCs
Processes:
Setup.exepid process 1940 Setup.exe -
Loads dropped DLL 1 IoCs
Processes:
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exepid process 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Setup.exepid process 1940 Setup.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exepid process 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exepid process 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exedescription pid process target process PID 1832 wrote to memory of 1940 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe Setup.exe PID 1832 wrote to memory of 1940 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe Setup.exe PID 1832 wrote to memory of 1940 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe Setup.exe PID 1832 wrote to memory of 1940 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe Setup.exe PID 1832 wrote to memory of 1940 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe Setup.exe PID 1832 wrote to memory of 1940 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe Setup.exe PID 1832 wrote to memory of 1940 1832 22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe"C:\Users\Admin\AppData\Local\Temp\22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Setup.exeC:\ProgramData\Setup.exe2⤵
- Modifies security service
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Setup.exeMD5
1d3072caa9c82faea4ce0aff3c267d5f
SHA145431656c6d6e841c40bc8e80bed891193caff21
SHA25648efc1e775c88e01600b049e1e55831fefaea5d624d94892a6efaa632181e2fe
SHA5129d26e856ace8d48382d16346bff089439f7263b2c3f9c4dbc2cd8a797a704ab2d447df0e303b4a40cead274d0871aec1819ee81c40697efb7c759cae27ff76f5
-
C:\ProgramData\Setup.exeMD5
1d3072caa9c82faea4ce0aff3c267d5f
SHA145431656c6d6e841c40bc8e80bed891193caff21
SHA25648efc1e775c88e01600b049e1e55831fefaea5d624d94892a6efaa632181e2fe
SHA5129d26e856ace8d48382d16346bff089439f7263b2c3f9c4dbc2cd8a797a704ab2d447df0e303b4a40cead274d0871aec1819ee81c40697efb7c759cae27ff76f5
-
\ProgramData\Setup.exeMD5
1d3072caa9c82faea4ce0aff3c267d5f
SHA145431656c6d6e841c40bc8e80bed891193caff21
SHA25648efc1e775c88e01600b049e1e55831fefaea5d624d94892a6efaa632181e2fe
SHA5129d26e856ace8d48382d16346bff089439f7263b2c3f9c4dbc2cd8a797a704ab2d447df0e303b4a40cead274d0871aec1819ee81c40697efb7c759cae27ff76f5
-
memory/1832-60-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1940-62-0x0000000000000000-mapping.dmp