8050946d45275d1d9a207b61e1e7c69f906193fe120b111497bb15960f9ca379

Analysis

max time kernel
10s
max time network
41s
platform
windows7_x64
resource
win7v20210408
submitted
10-09-2021 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fri1921f7a9d3.exe
Size

99KB
MD5

a1c7ed2563212e0aba70af8a654962fd
SHA1

987e944110921327adaba51d557dbf20dee886d5
SHA256

a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA512

60d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1584 892 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

560 rundll32.exe
560 rundll32.exe
560 rundll32.exe
560 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	892	rundll32.exe

pid	process
560	rundll32.exe
560	rundll32.exe
560	rundll32.exe
560	rundll32.exe

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1584 wrote to memory of 560	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 560	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 560	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 560	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 560	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 560	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 560	1584	rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\Fri1921f7a9d3.exe
"C:\Users\Admin\AppData\Local\Temp\Fri1921f7a9d3.exe"
1⤵
PID:2024

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
14ef50a8355a8ddbffbd19aff9936836

SHA1
7c44952baa2433c554228dbd50613d7bf347ada5

SHA256
fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9

SHA512
ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
14ef50a8355a8ddbffbd19aff9936836

SHA1
7c44952baa2433c554228dbd50613d7bf347ada5

SHA256
fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9

SHA512
ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
14ef50a8355a8ddbffbd19aff9936836

SHA1
7c44952baa2433c554228dbd50613d7bf347ada5

SHA256
fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9

SHA512
ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
14ef50a8355a8ddbffbd19aff9936836

SHA1
7c44952baa2433c554228dbd50613d7bf347ada5

SHA256
fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9

SHA512
ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
14ef50a8355a8ddbffbd19aff9936836

SHA1
7c44952baa2433c554228dbd50613d7bf347ada5

SHA256
fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9

SHA512
ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc

Download Submit
memory/560-62-0x0000000000000000-mapping.dmp

Download
memory/2024-60-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download