Resubmissions
01-09-2022 19:57
220901-ypp62scdh3 1013-06-2022 01:36
220613-b1kpdahbh9 1014-03-2022 23:17
220314-29pmssdeh2 8Analysis
-
max time kernel
4294308s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
14-03-2022 23:17
Static task
static1
Behavioral task
behavioral1
Sample
11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe
-
Size
256.0MB
-
MD5
0fa1be2db15ef78a9e01b21589204615
-
SHA1
933ad2d5ce1e31654a201b284abfc6ec88ad484c
-
SHA256
11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a
-
SHA512
13e51c96c51741348fa07d9072a686fc62d3f31af5d085893bce7247cd7de98d89e7d4318e69e7f4c3c3aa29ae41c9d6b1f98f73aab062dffbc7704a76e91be4
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1952 gggsfhzl.exe -
Loads dropped DLL 6 IoCs
pid Process 1952 gggsfhzl.exe 1952 gggsfhzl.exe 1188 MsiExec.exe 1188 MsiExec.exe 1188 MsiExec.exe 1188 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: gggsfhzl.exe File opened (read-only) \??\N: gggsfhzl.exe File opened (read-only) \??\Q: gggsfhzl.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: gggsfhzl.exe File opened (read-only) \??\F: gggsfhzl.exe File opened (read-only) \??\H: gggsfhzl.exe File opened (read-only) \??\X: gggsfhzl.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: gggsfhzl.exe File opened (read-only) \??\P: gggsfhzl.exe File opened (read-only) \??\R: gggsfhzl.exe File opened (read-only) \??\T: gggsfhzl.exe File opened (read-only) \??\Y: gggsfhzl.exe File opened (read-only) \??\Z: gggsfhzl.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: gggsfhzl.exe File opened (read-only) \??\O: gggsfhzl.exe File opened (read-only) \??\S: gggsfhzl.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: gggsfhzl.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: gggsfhzl.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: gggsfhzl.exe File opened (read-only) \??\G: gggsfhzl.exe File opened (read-only) \??\V: gggsfhzl.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: gggsfhzl.exe File opened (read-only) \??\U: gggsfhzl.exe File opened (read-only) \??\W: gggsfhzl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1484 1452 WerFault.exe 30 -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeCreateTokenPrivilege 1952 gggsfhzl.exe Token: SeAssignPrimaryTokenPrivilege 1952 gggsfhzl.exe Token: SeLockMemoryPrivilege 1952 gggsfhzl.exe Token: SeIncreaseQuotaPrivilege 1952 gggsfhzl.exe Token: SeMachineAccountPrivilege 1952 gggsfhzl.exe Token: SeTcbPrivilege 1952 gggsfhzl.exe Token: SeSecurityPrivilege 1952 gggsfhzl.exe Token: SeTakeOwnershipPrivilege 1952 gggsfhzl.exe Token: SeLoadDriverPrivilege 1952 gggsfhzl.exe Token: SeSystemProfilePrivilege 1952 gggsfhzl.exe Token: SeSystemtimePrivilege 1952 gggsfhzl.exe Token: SeProfSingleProcessPrivilege 1952 gggsfhzl.exe Token: SeIncBasePriorityPrivilege 1952 gggsfhzl.exe Token: SeCreatePagefilePrivilege 1952 gggsfhzl.exe Token: SeCreatePermanentPrivilege 1952 gggsfhzl.exe Token: SeBackupPrivilege 1952 gggsfhzl.exe Token: SeRestorePrivilege 1952 gggsfhzl.exe Token: SeShutdownPrivilege 1952 gggsfhzl.exe Token: SeDebugPrivilege 1952 gggsfhzl.exe Token: SeAuditPrivilege 1952 gggsfhzl.exe Token: SeSystemEnvironmentPrivilege 1952 gggsfhzl.exe Token: SeChangeNotifyPrivilege 1952 gggsfhzl.exe Token: SeRemoteShutdownPrivilege 1952 gggsfhzl.exe Token: SeUndockPrivilege 1952 gggsfhzl.exe Token: SeSyncAgentPrivilege 1952 gggsfhzl.exe Token: SeEnableDelegationPrivilege 1952 gggsfhzl.exe Token: SeManageVolumePrivilege 1952 gggsfhzl.exe Token: SeImpersonatePrivilege 1952 gggsfhzl.exe Token: SeCreateGlobalPrivilege 1952 gggsfhzl.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeSecurityPrivilege 940 msiexec.exe Token: SeCreateTokenPrivilege 1952 gggsfhzl.exe Token: SeAssignPrimaryTokenPrivilege 1952 gggsfhzl.exe Token: SeLockMemoryPrivilege 1952 gggsfhzl.exe Token: SeIncreaseQuotaPrivilege 1952 gggsfhzl.exe Token: SeMachineAccountPrivilege 1952 gggsfhzl.exe Token: SeTcbPrivilege 1952 gggsfhzl.exe Token: SeSecurityPrivilege 1952 gggsfhzl.exe Token: SeTakeOwnershipPrivilege 1952 gggsfhzl.exe Token: SeLoadDriverPrivilege 1952 gggsfhzl.exe Token: SeSystemProfilePrivilege 1952 gggsfhzl.exe Token: SeSystemtimePrivilege 1952 gggsfhzl.exe Token: SeProfSingleProcessPrivilege 1952 gggsfhzl.exe Token: SeIncBasePriorityPrivilege 1952 gggsfhzl.exe Token: SeCreatePagefilePrivilege 1952 gggsfhzl.exe Token: SeCreatePermanentPrivilege 1952 gggsfhzl.exe Token: SeBackupPrivilege 1952 gggsfhzl.exe Token: SeRestorePrivilege 1952 gggsfhzl.exe Token: SeShutdownPrivilege 1952 gggsfhzl.exe Token: SeDebugPrivilege 1952 gggsfhzl.exe Token: SeAuditPrivilege 1952 gggsfhzl.exe Token: SeSystemEnvironmentPrivilege 1952 gggsfhzl.exe Token: SeChangeNotifyPrivilege 1952 gggsfhzl.exe Token: SeRemoteShutdownPrivilege 1952 gggsfhzl.exe Token: SeUndockPrivilege 1952 gggsfhzl.exe Token: SeSyncAgentPrivilege 1952 gggsfhzl.exe Token: SeEnableDelegationPrivilege 1952 gggsfhzl.exe Token: SeManageVolumePrivilege 1952 gggsfhzl.exe Token: SeImpersonatePrivilege 1952 gggsfhzl.exe Token: SeCreateGlobalPrivilege 1952 gggsfhzl.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1952 gggsfhzl.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1120 wrote to memory of 1952 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 29 PID 1120 wrote to memory of 1952 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 29 PID 1120 wrote to memory of 1952 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 29 PID 1120 wrote to memory of 1952 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 29 PID 1120 wrote to memory of 1952 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 29 PID 1120 wrote to memory of 1952 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 29 PID 1120 wrote to memory of 1952 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 29 PID 1120 wrote to memory of 1452 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 30 PID 1120 wrote to memory of 1452 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 30 PID 1120 wrote to memory of 1452 1120 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 30 PID 1452 wrote to memory of 1484 1452 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 31 PID 1452 wrote to memory of 1484 1452 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 31 PID 1452 wrote to memory of 1484 1452 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 31 PID 940 wrote to memory of 1188 940 msiexec.exe 33 PID 940 wrote to memory of 1188 940 msiexec.exe 33 PID 940 wrote to memory of 1188 940 msiexec.exe 33 PID 940 wrote to memory of 1188 940 msiexec.exe 33 PID 940 wrote to memory of 1188 940 msiexec.exe 33 PID 940 wrote to memory of 1188 940 msiexec.exe 33 PID 940 wrote to memory of 1188 940 msiexec.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe"C:\Users\Admin\AppData\Local\Temp\11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\gggsfhzl.exe"C:\Users\Admin\AppData\Local\Temp\gggsfhzl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe"C:\Users\Admin\AppData\Local\Temp\11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe" /i2⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1452 -s 5923⤵
- Program crash
PID:1484
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9903DC56DB53F0D005C1C2F124332776 C2⤵
- Loads dropped DLL
PID:1188
-