Overview

overview

10

Static

static

398f2d4704...a7.exe

windows7_x64

10

398f2d4704...a7.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    102s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    05-03-2022 19:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    398f2d4704aa884e676cf971b7cfaba82ce8b0d791b63b51c36bd76b4484cca7.exe

  • Size

    1.3MB

  • MD5

    056a68f7c923ced5e13df36cd7ffba93

  • SHA1

    a386d3650975bafd35aee69cd59b895780b0b70b

  • SHA256

    398f2d4704aa884e676cf971b7cfaba82ce8b0d791b63b51c36bd76b4484cca7

  • SHA512

    b218331bbdfc793a490a0b82d38300d1aeb829b355ec91c8a7a80f78772052d6a0dcd7a8bd65d9e85f28b4b010deb0537c9c6cc526381f9f8649fbdae8bb514b

Score
10/10
ouroborosevasionransomwarespywarestealer

Malware Config

Signatures

  • Ouroboros/Zeropadypt

    Ransomware family based on open-source CryptoWire.

    ransomwareouroboros
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 47 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Program crash 2 IoCs
  • NTFS ADS 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\398f2d4704aa884e676cf971b7cfaba82ce8b0d791b63b51c36bd76b4484cca7.exe
    "C:\Users\Admin\AppData\Local\Temp\398f2d4704aa884e676cf971b7cfaba82ce8b0d791b63b51c36bd76b4484cca7.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:32
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSDTC
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Windows\SysWOW64\net.exe
        net stop MSDTC
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSDTC
          4⤵
            PID:2432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:3576
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
          2⤵
            PID:4024
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
            2⤵
              PID:1928
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1840
              • C:\Windows\SysWOW64\net.exe
                net stop SQLSERVERAGENT
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3052
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop SQLSERVERAGENT
                  4⤵
                    PID:3284
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3784
                • C:\Windows\SysWOW64\net.exe
                  net stop MSSQLSERVER
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:112
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop MSSQLSERVER
                    4⤵
                      PID:3760
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c net stop vds
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3520
                  • C:\Windows\SysWOW64\net.exe
                    net stop vds
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2572
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop vds
                      4⤵
                        PID:2912
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1508
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall set currentprofile state off
                      3⤵
                        PID:3312
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:832
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall set opmode mode=disable
                        3⤵
                          PID:2796
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c net stop SQLWriter
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2740
                        • C:\Windows\SysWOW64\net.exe
                          net stop SQLWriter
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:512
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop SQLWriter
                            4⤵
                              PID:3636
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                          2⤵
                            PID:2792
                            • C:\Windows\SysWOW64\net.exe
                              net stop SQLBrowser
                              3⤵
                                PID:3748
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop SQLBrowser
                                  4⤵
                                    PID:904
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                2⤵
                                  PID:2340
                                  • C:\Windows\SysWOW64\net.exe
                                    net stop MSSQLSERVER
                                    3⤵
                                      PID:4004
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 stop MSSQLSERVER
                                        4⤵
                                          PID:4092
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                      2⤵
                                        PID:3544
                                        • C:\Windows\SysWOW64\net.exe
                                          net stop MSSQL$CONTOSO1
                                          3⤵
                                            PID:3420
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                              4⤵
                                                PID:3976
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -pss -s 464 -p 2308 -ip 2308
                                          1⤵
                                            PID:3344
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 2308 -s 3108
                                            1⤵
                                            • Program crash
                                            PID:3696
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2740
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3532
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:60
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -u -p 60 -s 4040
                                                    2⤵
                                                    • Program crash
                                                    PID:2604
                                                • C:\Windows\system32\WerFault.exe
                                                  C:\Windows\system32\WerFault.exe -pss -s 516 -p 60 -ip 60
                                                  1⤵
                                                    PID:2372

                                                  Network

                                                  MITRE ATT&CK Enterprise v6

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.[[email protected]][EBY0FPLKMI3NVS1].Horizon
                                                    MD5

                                                    56281bfe29309b574a01a97dd846bcb3

                                                    SHA1

                                                    4085e2c3f307c82f9577934261ac9817794ea634

                                                    SHA256

                                                    1c933fe50a8769dfe8e42b3d4a852c4afcd3d35698940c82c8615142a0463f69

                                                    SHA512

                                                    7403bd17e99d3789d2f5e1f6927dcd203354835a34fc89abf2c6a0f147f089b87f7bee7b9e44d5bfe101760e3553537318acb7a58b99b061e68d1385333bf8d3

                                                    Download Submit

                                                  • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.[[email protected]][EBY0FPLKMI3NVS1].Horizon
                                                    MD5

                                                    fceb1a1e402a457732c43d5192c29609

                                                    SHA1

                                                    09ca8e8e0f334dc1cc9bd72fd8d1247da95d8433

                                                    SHA256

                                                    2701ca4f3cf3a01561ef31f00a260c5c8d6ef55a970f1956a7b14d625e50cc03

                                                    SHA512

                                                    916343d96e38515e0b82c324f00646d56b02e12555df31161aadf462e26a8b6b6ba25026d5acd84cf08924fb8c4aec01d97f202906bba4f82e19caa26c2bea4b

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.[[email protected]][EBY0FPLKMI3NVS1].Horizon
                                                    MD5

                                                    9e20cd2c32af173cbb5532be507a4aae

                                                    SHA1

                                                    7b4464f913be6d2c164d5119eb14b8ea714f3d69

                                                    SHA256

                                                    8eaeee1fda99c43691dc044d4674fc2567d3d6149f3585d08011065ec3b7c2c3

                                                    SHA512

                                                    828bd28b536ce3f347ce40a9e87fbd0a0a27ac1ba87f203d38199933754ffd982d42e08f1871394d895524ff35b0a8b8aed92c923a122fe97ce523e5b1e8aca8

                                                    Download Submit