Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 14:40
Static task
static1
Behavioral task
behavioral1
Sample
7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe
Resource
win10-en-20211208
General
-
Target
7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe
-
Size
1.4MB
-
MD5
48dee0033baf8d606b2fbb649a6e4b71
-
SHA1
fbd97a00132d02df575aba0b332d3febbad7aa75
-
SHA256
7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4
-
SHA512
fafac3b39e12688a47a81d515f192b278a3a7212019f10b04992774768979000212b426d6d03a05de1905ce9dbca09b75f3a34def4c4e5265e054909dc0290eb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
mnd.exemnd.exepid process 584 mnd.exe 1392 mnd.exe -
Processes:
resource yara_rule behavioral1/memory/1012-77-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1012-79-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1012-81-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1928-97-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1928-98-0x0000000001610000-0x000000000171E000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exemnd.exepid process 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe 584 mnd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mnd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run mnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdatere = "C:\\Users\\Admin\\AppData\\Roaming\\ugt\\mnd.exe C:\\Users\\Admin\\AppData\\Roaming\\ugt\\vpt-ipi" mnd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
mnd.exeRegSvcs.exeRegSvcs.exedescription pid process target process PID 1392 set thread context of 1092 1392 mnd.exe RegSvcs.exe PID 1392 set thread context of 1684 1392 mnd.exe RegSvcs.exe PID 1092 set thread context of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1684 set thread context of 1928 1684 RegSvcs.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
mnd.exeRegSvcs.exeRegSvcs.exepid process 584 mnd.exe 1928 RegSvcs.exe 1012 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegSvcs.exeRegSvcs.exepid process 1092 RegSvcs.exe 1684 RegSvcs.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exemnd.exemnd.exeRegSvcs.exeRegSvcs.exedescription pid process target process PID 1128 wrote to memory of 584 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe mnd.exe PID 1128 wrote to memory of 584 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe mnd.exe PID 1128 wrote to memory of 584 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe mnd.exe PID 1128 wrote to memory of 584 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe mnd.exe PID 1128 wrote to memory of 584 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe mnd.exe PID 1128 wrote to memory of 584 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe mnd.exe PID 1128 wrote to memory of 584 1128 7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe mnd.exe PID 584 wrote to memory of 1392 584 mnd.exe mnd.exe PID 584 wrote to memory of 1392 584 mnd.exe mnd.exe PID 584 wrote to memory of 1392 584 mnd.exe mnd.exe PID 584 wrote to memory of 1392 584 mnd.exe mnd.exe PID 584 wrote to memory of 1392 584 mnd.exe mnd.exe PID 584 wrote to memory of 1392 584 mnd.exe mnd.exe PID 584 wrote to memory of 1392 584 mnd.exe mnd.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1092 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1392 wrote to memory of 1684 1392 mnd.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1092 wrote to memory of 1012 1092 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe PID 1684 wrote to memory of 1928 1684 RegSvcs.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe"C:\Users\Admin\AppData\Local\Temp\7516c84a016536e17d94740142f22e375d010a76b7610eddd12043b1676c6db4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ugt\mnd.exe"C:\Users\Admin\AppData\Roaming\ugt\mnd.exe" vpt-ipi2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ugt\mnd.exeC:\Users\Admin\AppData\Roaming\ugt\mnd.exe C:\Users\Admin\AppData\Roaming\ugt\KZYCX3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe5⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zUB8dknwC\zUB8dknwC.datMD5
93e00066d099c0485cfffa1359246d26
SHA1bc69a773f37b2f2071e25f755a66d47b871e5d98
SHA2563b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde
SHA512d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zUB8dknwC\zUB8dknwC.nfoMD5
5da5f797e19da65017db699019c7c4e6
SHA161e6ac756c58e361325a9d1ecc306cfd70a7e477
SHA256f7dbb6b03e18c8ea542f56b689540561a56438083ba93a0dfaf13a5217ce432c
SHA512570f47fe0028ba1b53b764beb7716a1596d7a7085c5b232ae3ec4c0bfa535ca0c9e4372b5254aeefd11ed9b73dc0f8919835e3c4ade9b0662ed942171cda930b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zUB8dknwC\zUB8dknwC.svrMD5
74b95118128f276328bd18db61c141f0
SHA1b83ec9f9c9db285cc8a39ba196a487eaa9a831d7
SHA25695e4f8cf64c5311a338587db944bf1c18bcbe705226b7aa81a46fb96bff0a7e5
SHA51297b8b6f0b0df20445fa7db9d7656d8b2f50c542a1c90d9df4bceabad73be39643b736a15d8b0ffaac9809ee0d9c6a4fcdc1f57579d57ceb79e0529a09bedcc28
-
C:\Users\Admin\AppData\Roaming\ugt\KZYCXMD5
5db96f1aa7be4a9c99b52c7a3a0581ca
SHA1f6d2c9cb4b45414051f9b4678eef015f6baa5366
SHA25695158e531eebb60f2fc6798f2112625cc016bf119c9282e8757424feded27110
SHA512b014efdef22b773b8403fed2fbab681a2135d104e012f2a43234328397b356341506f0c056af07b433bf0b7889092f0d21b2505fc92663b7cf4340c0207a3a8e
-
C:\Users\Admin\AppData\Roaming\ugt\lmb.bmpMD5
cef25a2da0595496bf5fe8477f928ee0
SHA1205246ecfbbe774d2af134d992c77aa410f28fc1
SHA2563a8f1a2b200c6d7340dc8fb0b9710cee28e1ddd097fe0c0b1168cdc93228423e
SHA5123cb8d3665f358f152b48ef7179649cac257c2e00db8a26b02c26d85992f3932b3d4d6214150d0be9fd58a953b693faaf44224d036a48a348df1ade82e76f5c46
-
C:\Users\Admin\AppData\Roaming\ugt\mnd.exeMD5
71d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\AppData\Roaming\ugt\mnd.exeMD5
71d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\AppData\Roaming\ugt\mnd.exeMD5
71d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\AppData\Roaming\ugt\vpt-ipiMD5
ececabf7b2dedf9d16c3648451d4d309
SHA18300e0d3d60ebe3d84bd8bc6171e674d11bc38f5
SHA256690b21fcdb4be63a6a1a6448fbd47cd42edfb7b9ce44510c7cb28f61a3138483
SHA51276d4855ce2125d8d74c9234eb5e93cea94fc4266ed0089860ddcc921fc570ac3cc75ec3565902c0b7cb9693cb125fc90bc5e22775767170789eab34c7dc89c9a
-
\Users\Admin\AppData\Roaming\ugt\mnd.exeMD5
71d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\AppData\Roaming\ugt\mnd.exeMD5
71d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\AppData\Roaming\ugt\mnd.exeMD5
71d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\AppData\Roaming\ugt\mnd.exeMD5
71d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\AppData\Roaming\ugt\mnd.exeMD5
71d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
memory/1012-79-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1012-81-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1012-76-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1012-77-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1092-70-0x0000000000490000-0x000000000C350000-memory.dmpFilesize
190.8MB
-
memory/1092-71-0x0000000000490000-0x000000000C350000-memory.dmpFilesize
190.8MB
-
memory/1092-73-0x0000000000490000-0x000000000C4C0000-memory.dmpFilesize
192.2MB
-
memory/1128-55-0x0000000075421000-0x0000000075423000-memory.dmpFilesize
8KB
-
memory/1684-74-0x0000000000440000-0x000000000869D000-memory.dmpFilesize
130.4MB
-
memory/1684-75-0x0000000000440000-0x000000000869D000-memory.dmpFilesize
130.4MB
-
memory/1684-88-0x0000000000440000-0x000000000869D000-memory.dmpFilesize
130.4MB
-
memory/1928-97-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1928-98-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1928-99-0x0000000001611000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1928-100-0x00000000016C4000-0x000000000171C000-memory.dmpFilesize
352KB
-
memory/1928-101-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB