Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 03:51
Static task
static1
Behavioral task
behavioral1
Sample
5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe
Resource
win7-en-20211208
General
-
Target
5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe
-
Size
213KB
-
MD5
a6bea852441fd3a2658d4882f1823492
-
SHA1
396958216e3251d56fc704072cd9679aa8517412
-
SHA256
5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92
-
SHA512
ca4524303dd48c04b326acfe59750eed576c842314f6fc7a6d61e0254b8e89490b5db09749fda4ebd43523135923a878aac93aa2961de47a7f2b7def134f47dc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 584 system.exe -
Drops startup file 1 IoCs
Processes:
5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mysystem.lnk 5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
system.exedescription pid process Token: SeDebugPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe Token: 33 584 system.exe Token: SeIncBasePriorityPrivilege 584 system.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exepid process 964 5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe 964 5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exedescription pid process target process PID 964 wrote to memory of 584 964 5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe system.exe PID 964 wrote to memory of 584 964 5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe system.exe PID 964 wrote to memory of 584 964 5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe system.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe"C:\Users\Admin\AppData\Local\Temp\5127c48b8bf8414bde0e4f4801022e71b15066ec0175b476ea071c595ecf4b92.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\system.exeMD5
22249eb9eda56570f33b44b2ad5f66d7
SHA1642d93447cfac014b556eebbc997890f09574172
SHA256ec83453b6fbd05e56ae0a4992b123500ddc36ce3083f113ff44a4e368ec8bc81
SHA512e9b714ae146482d358cfa6e914c2a1dfd81b163cf48a53c0359b2295357fb36f1e998f67a44a042d06e4f2c66df79c5f576b0475114079763feb7815cbb36bf1
-
C:\Users\Admin\AppData\Local\Temp\system.exeMD5
22249eb9eda56570f33b44b2ad5f66d7
SHA1642d93447cfac014b556eebbc997890f09574172
SHA256ec83453b6fbd05e56ae0a4992b123500ddc36ce3083f113ff44a4e368ec8bc81
SHA512e9b714ae146482d358cfa6e914c2a1dfd81b163cf48a53c0359b2295357fb36f1e998f67a44a042d06e4f2c66df79c5f576b0475114079763feb7815cbb36bf1
-
memory/584-63-0x0000000001F60000-0x0000000001F62000-memory.dmpFilesize
8KB
-
memory/584-62-0x000007FEF1F20000-0x000007FEF2FB6000-memory.dmpFilesize
16.6MB
-
memory/964-59-0x0000000000247000-0x0000000000248000-memory.dmpFilesize
4KB
-
memory/964-58-0x0000000000246000-0x0000000000247000-memory.dmpFilesize
4KB
-
memory/964-54-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/964-56-0x0000000000226000-0x0000000000245000-memory.dmpFilesize
124KB
-
memory/964-57-0x0000000000245000-0x0000000000246000-memory.dmpFilesize
4KB
-
memory/964-64-0x0000000000249000-0x000000000024A000-memory.dmpFilesize
4KB
-
memory/964-55-0x000007FEF1F20000-0x000007FEF2FB6000-memory.dmpFilesize
16.6MB
-
memory/964-65-0x000000000024E000-0x000000000024F000-memory.dmpFilesize
4KB
-
memory/964-66-0x000000000024A000-0x000000000024B000-memory.dmpFilesize
4KB