Analysis
-
max time kernel
151s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-09-2021 14:12
Static task
static1
Behavioral task
behavioral1
Sample
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe
Resource
win7-en-20210920
General
-
Target
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe
-
Size
310KB
-
MD5
7d800ad9f415b03e6bb9a029fa57a3ec
-
SHA1
73d737b77a8fea41dad18dc6cdde0892b0dc9796
-
SHA256
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145
-
SHA512
5549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
System.exepid process 964 System.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
System.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f65c7a4a4880bc336b681db036e15111.exe System.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f65c7a4a4880bc336b681db036e15111.exe System.exe -
Loads dropped DLL 1 IoCs
Processes:
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exepid process 1128 ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe -
Drops file in Windows directory 2 IoCs
Processes:
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
System.exedescription pid process Token: SeDebugPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe Token: 33 964 System.exe Token: SeIncBasePriorityPrivilege 964 System.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exeSystem.exedescription pid process target process PID 1128 wrote to memory of 964 1128 ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe System.exe PID 1128 wrote to memory of 964 1128 ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe System.exe PID 1128 wrote to memory of 964 1128 ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe System.exe PID 1128 wrote to memory of 964 1128 ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe System.exe PID 964 wrote to memory of 1620 964 System.exe netsh.exe PID 964 wrote to memory of 1620 964 System.exe netsh.exe PID 964 wrote to memory of 1620 964 System.exe netsh.exe PID 964 wrote to memory of 1620 964 System.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe"C:\Users\Admin\AppData\Local\Temp\ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System.exe"C:\Users\Admin\AppData\Roaming\System.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\System.exe" "System.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\System.exeMD5
7d800ad9f415b03e6bb9a029fa57a3ec
SHA173d737b77a8fea41dad18dc6cdde0892b0dc9796
SHA256ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145
SHA5125549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a
-
C:\Users\Admin\AppData\Roaming\System.exeMD5
7d800ad9f415b03e6bb9a029fa57a3ec
SHA173d737b77a8fea41dad18dc6cdde0892b0dc9796
SHA256ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145
SHA5125549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a
-
\Users\Admin\AppData\Roaming\System.exeMD5
7d800ad9f415b03e6bb9a029fa57a3ec
SHA173d737b77a8fea41dad18dc6cdde0892b0dc9796
SHA256ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145
SHA5125549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a
-
memory/964-57-0x0000000000000000-mapping.dmp
-
memory/964-61-0x0000000001FF0000-0x0000000001FF1000-memory.dmpFilesize
4KB
-
memory/1128-54-0x0000000074B41000-0x0000000074B43000-memory.dmpFilesize
8KB
-
memory/1128-55-0x0000000002240000-0x0000000002241000-memory.dmpFilesize
4KB
-
memory/1620-62-0x0000000000000000-mapping.dmp