Overview

overview

9

Static

static

fe5d565b1f...04.exe

windows7_x64

9

fe5d565b1f...04.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    162s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    01-02-2022 02:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fe5d565b1f7b0a5b25edf491dafb826ab4270d99e574ba716baa99fd224aa504.exe

  • Size

    287KB

  • MD5

    3a7cf1131fb5d7b200d76884a27d17e2

  • SHA1

    dcb545a6f61c545a47079c4be5b75d7f2e7ff8b6

  • SHA256

    fe5d565b1f7b0a5b25edf491dafb826ab4270d99e574ba716baa99fd224aa504

  • SHA512

    f4af3e0c00fee64aa9a388f6b1d9b304fad2fd97402c1f579c746885f3751d94dac3f1573374392ec904c82d88a0fec8b3acd290a3d299204dbcc7f9438cca9a

Score
8/10
persistenceransomwarespywarestealer

Malware Config

Signatures

  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe5d565b1f7b0a5b25edf491dafb826ab4270d99e574ba716baa99fd224aa504.exe
    "C:\Users\Admin\AppData\Local\Temp\fe5d565b1f7b0a5b25edf491dafb826ab4270d99e574ba716baa99fd224aa504.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Local\Temp\fe5d565b1f7b0a5b25edf491dafb826ab4270d99e574ba716baa99fd224aa504.exe
      "C:\Users\Admin\AppData\Local\Temp\fe5d565b1f7b0a5b25edf491dafb826ab4270d99e574ba716baa99fd224aa504.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\__t577A.tmp.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
          4⤵
            PID:2152
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
            4⤵
              PID:3260
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
              4⤵
                PID:2272
              • C:\Windows\SysWOW64\attrib.exe
                attrib Default.rdp -s -h
                4⤵
                • Views/modifies file attributes
                PID:1852
        • C:\Windows\System32\WaaSMedicAgent.exe
          C:\Windows\System32\WaaSMedicAgent.exe e14b1fbe0b66a7edd78b2425d671ca6a 7s8fIIQQMEmz3ID6MaZggQ.0.1.0.0.0
          1⤵
          • Modifies data under HKEY_USERS
          PID:1800

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Registry Run Keys / Startup Folder

        2
        T1060

        Hidden Files and Directories

        1
        T1158

        Privilege Escalation

        Defense Evasion

        Modify Registry

        2
        T1112

        Hidden Files and Directories

        1
        T1158

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__t577A.tmp.bat
          MD5

          32d8f7a3d0c796cee45f64b63c1cca38

          SHA1

          d58466430a2bba8641bd92c880557379e25b140c

          SHA256

          1a6f73b5c28d1c10f63f2056068c1de61487b8cf8f1dcf7516548df144b3e9ea

          SHA512

          288213b92a03ac750ea319bb23c52e7bdf47f5a47ecb70c905c7610a84c63a3ec0a30801b5880e6def8df2c9f577082072e342198d23a19f64e561923e1ef698

          Download Submit
        • memory/1488-133-0x0000000000690000-0x00000000006D1000-memory.dmp
          Filesize

          260KB

          Download
        • memory/2992-134-0x0000000000400000-0x0000000000428000-memory.dmp
          Filesize

          160KB

          Download
        • memory/2992-136-0x0000000000400000-0x0000000000428000-memory.dmp
          Filesize

          160KB

          Download