Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08-12-2021 17:49
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-en-20211208
General
-
Target
sample.exe
-
Size
747KB
-
MD5
ae99e6a451bc53830be799379f5c1104
-
SHA1
f79ea5b6b14cbbd947585c78c2446becaef803b7
-
SHA256
772cad26853c7d8ea8f1023f6e3cba219cc9bb1db1cd31ad2b979e59d3d9c631
-
SHA512
4e109061ec24a4772ad8930a7a6038ff3bc318cf3de6dde3dacdf5f34bb37ead18e82ec5bf377e2b7229df81e0e94a73447c086e74006be321ab0cc414b92e31
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\__$$RECOVERY_README$$__.html
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 368 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
sample.exedescription pid process target process PID 764 wrote to memory of 1884 764 sample.exe cmd.exe PID 764 wrote to memory of 1884 764 sample.exe cmd.exe PID 764 wrote to memory of 1884 764 sample.exe cmd.exe PID 764 wrote to memory of 1884 764 sample.exe cmd.exe PID 764 wrote to memory of 368 764 sample.exe cmd.exe PID 764 wrote to memory of 368 764 sample.exe cmd.exe PID 764 wrote to memory of 368 764 sample.exe cmd.exe PID 764 wrote to memory of 368 764 sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\sample.exe >> NUL2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1.bat" "2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1.batMD5
2a284738125555714876fb06ecd16e20
SHA1f10c76cf311c2c5ae8a499b198c27e695472ef36
SHA2569e468326155e1d5d32da535276e72c841ab3592f33d5474972fba3da3f92d639
SHA512e5941e1bf45ed5160d321d4e20cdba40ffeb3078f72c57bf3285c9a034d768196f644960136456f248fc8ed3f22aff512e41aba19a96cfe49090ece491c8d7bc
-
memory/368-56-0x0000000000000000-mapping.dmp
-
memory/764-54-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1884-55-0x0000000000000000-mapping.dmp