Analysis
-
max time kernel
123s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 14:18
General
-
Target
E3EA35FA7F983485414E4991F7B691F2D8938CD296A186A0F6D83D41D604F424.exe
-
Size
45.2MB
-
MD5
e54c7926d270556a8431f5a1bd9f170d
-
SHA1
4ee0d0c23e5f02d9baeaadb013a88bf675ab6679
-
SHA256
e3ea35fa7f983485414e4991f7b691f2d8938cd296a186a0f6d83d41d604f424
-
SHA512
7a63d708877c14cdb50b10683338416374ef72d5d88d6daf4a33acf92363fb5635f7d999db84e0b630278070071c8946da03b139d1db1e8b69a951666ce3126c
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\E3EA35FA7F983485414E4991F7B691F2D8938CD296A186A0F6D83D41D604F424.exe"C:\Users\Admin\AppData\Local\Temp\E3EA35FA7F983485414E4991F7B691F2D8938CD296A186A0F6D83D41D604F424.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Vinny27.cmd" /S"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mode.commode 132,363⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exesetup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-77UBH.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-77UBH.tmp\setup.tmp" /SL5="$60080,83901318,831488,C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\xcopy.exe"xcopy.exe" "Vinny27\pkey.txt" "C:\Program Files (x86)\FinalWire\AIDA64 Business\" /s /i /r /v /k /f /c /h /y3⤵
- Drops file in Program Files directory
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Vinny27.cmdMD5
d98a0e1c48a29ecc3835abbc4af60a8a
SHA1f7e8134df925e3a2a011a59f98d8648a06694037
SHA256f984d4808ec9ff39102c2efbc7750dae8f3750ade91771269ebf482c5ba20370
SHA512e821ce65eae38f53c3a8abb253a670bb00911cdab9e0054a357c4697363b20e3944dfd36f0b1644604a7d462b7296af28f43d54ad5a6e45cb6c9b77f2bbff87e
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Vinny27\pkey.txtMD5
738b75560f21128d58608ed6a7820e3c
SHA18159b21ca357f3e9d84a1efee8e57ea0472ea229
SHA256ee5bc53d6214ee6e86a84e8eb79c9265665bc0eaa486ddbbf3868ccee91fbb49
SHA512aaf01745545a807297ac32290510961d368ad650acda69805560d6fcdbd4fe9a87e0ede71dd48eba644c5dddc1ec0e1718dc87000f280bf662ab69c904e50930
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exeMD5
1d0116582c0c0c97162b8e2df022a01a
SHA13ac232321ede6c0be10075562c2c2d7ccea7348a
SHA25654aa96dc51a85bf16db4b42ce3f2133511dcc9bb912c72ee2ca9ba049ebe94ee
SHA512b73c71b199d79f3175f3fe16d1c74a0e3638e5887ebc1a3827c91fd814ff4317afcb3d8602a3aae2989fb1588f6f7cb52f944e4faadb9bf276bbdd7d94683705
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exeMD5
1d0116582c0c0c97162b8e2df022a01a
SHA13ac232321ede6c0be10075562c2c2d7ccea7348a
SHA25654aa96dc51a85bf16db4b42ce3f2133511dcc9bb912c72ee2ca9ba049ebe94ee
SHA512b73c71b199d79f3175f3fe16d1c74a0e3638e5887ebc1a3827c91fd814ff4317afcb3d8602a3aae2989fb1588f6f7cb52f944e4faadb9bf276bbdd7d94683705
-
C:\Users\Admin\AppData\Local\Temp\is-77UBH.tmp\setup.tmpMD5
dd4ab9a411613c117256eaff11d8bb36
SHA1c80752721462dbca7b6d10b96be020a73346887d
SHA256a6ab1b5bc86f2ef64970ba745e42883ab6379f1590daf8a366334ee0eb112f8e
SHA512f203ac48aac1552581770ff22e50503c21253a36f0d16c08583280c3f3a1a81b828360897611a487fdd6b6019b2a25220e979093012860ef7747512e7193d48f
-
C:\Users\Admin\AppData\Local\Temp\is-77UBH.tmp\setup.tmpMD5
dd4ab9a411613c117256eaff11d8bb36
SHA1c80752721462dbca7b6d10b96be020a73346887d
SHA256a6ab1b5bc86f2ef64970ba745e42883ab6379f1590daf8a366334ee0eb112f8e
SHA512f203ac48aac1552581770ff22e50503c21253a36f0d16c08583280c3f3a1a81b828360897611a487fdd6b6019b2a25220e979093012860ef7747512e7193d48f
-
memory/380-129-0x0000000000000000-mapping.dmp
-
memory/724-125-0x0000000000000000-mapping.dmp
-
memory/724-128-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/792-115-0x0000000000000000-mapping.dmp
-
memory/1356-117-0x0000000000000000-mapping.dmp
-
memory/3204-118-0x0000000000000000-mapping.dmp
-
memory/3948-119-0x0000000000000000-mapping.dmp
-
memory/3948-124-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB