Analysis
-
max time kernel
119s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17/02/2022, 00:15
Static task
static1
Behavioral task
behavioral1
Sample
7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe
Resource
win10v2004-en-20220112
General
-
Target
7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe
-
Size
71KB
-
MD5
35574317584c78871e0d787645d8181e
-
SHA1
11353f230b64352a9cff542f4879a44750b16357
-
SHA256
7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32
-
SHA512
ba980ab3563a4f0ba705680110335f4e709462b8f223513f41d8e45785d7deffe99fa55d7881bc434edd9734725e0b33f6dbbc193a95de84ad1923b1587bfc0e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1148 offiice365.exe -
resource yara_rule behavioral1/files/0x0007000000012662-56.dat upx behavioral1/files/0x0007000000012662-57.dat upx behavioral1/files/0x0007000000012662-58.dat upx -
Loads dropped DLL 2 IoCs
pid Process 740 7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe 740 7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ offiice365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\officeii365 = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\offiice365.exe" offiice365.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 740 wrote to memory of 1148 740 7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe 27 PID 740 wrote to memory of 1148 740 7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe 27 PID 740 wrote to memory of 1148 740 7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe 27 PID 740 wrote to memory of 1148 740 7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe"C:\Users\Admin\AppData\Local\Temp\7e059a9dff0bf5fb8cacf9bf79ccf2d97e18e94730663ced41e4bdca95aecf32.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Roaming\Install\offiice365.exe"C:\Users\Admin\AppData\Roaming\Install\offiice365.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1148
-