Analysis
-
max time kernel
4294180s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
14-03-2022 14:39
Static task
static1
Behavioral task
behavioral1
Sample
Mto-Medical-Review-Form.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Mto-Medical-Review-Form.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Mto-Medical-Review-Form.exe
-
Size
261.0MB
-
MD5
7194384ed0ce511e24b0e119d0d068f6
-
SHA1
9ea9e3f52602988a922e8d8fda000f060be2b248
-
SHA256
7cc35fbce4b353c541f1ee62366248cc072d1c7ce38b1d5ef5db4a2414f26e08
-
SHA512
0faea84e368d301b7b056630b82c9f2a49f01252e66f5699ddf81f879d22fc74e08a810252e87a58cd9e5b147e9c1682678308781d08fd65e2edb2c8017c98d7
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1652 hbebfgwa.exe -
Loads dropped DLL 6 IoCs
pid Process 1652 hbebfgwa.exe 1652 hbebfgwa.exe 2032 MsiExec.exe 2032 MsiExec.exe 2032 MsiExec.exe 2032 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: hbebfgwa.exe File opened (read-only) \??\P: hbebfgwa.exe File opened (read-only) \??\S: hbebfgwa.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: hbebfgwa.exe File opened (read-only) \??\I: hbebfgwa.exe File opened (read-only) \??\U: hbebfgwa.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: hbebfgwa.exe File opened (read-only) \??\R: hbebfgwa.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: hbebfgwa.exe File opened (read-only) \??\Y: hbebfgwa.exe File opened (read-only) \??\Z: hbebfgwa.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: hbebfgwa.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: hbebfgwa.exe File opened (read-only) \??\B: hbebfgwa.exe File opened (read-only) \??\E: hbebfgwa.exe File opened (read-only) \??\G: hbebfgwa.exe File opened (read-only) \??\N: hbebfgwa.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: hbebfgwa.exe File opened (read-only) \??\M: hbebfgwa.exe File opened (read-only) \??\V: hbebfgwa.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: hbebfgwa.exe File opened (read-only) \??\O: hbebfgwa.exe File opened (read-only) \??\T: hbebfgwa.exe File opened (read-only) \??\W: hbebfgwa.exe File opened (read-only) \??\A: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 976 1292 WerFault.exe 28 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1652 hbebfgwa.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeCreateTokenPrivilege 1652 hbebfgwa.exe Token: SeAssignPrimaryTokenPrivilege 1652 hbebfgwa.exe Token: SeLockMemoryPrivilege 1652 hbebfgwa.exe Token: SeIncreaseQuotaPrivilege 1652 hbebfgwa.exe Token: SeMachineAccountPrivilege 1652 hbebfgwa.exe Token: SeTcbPrivilege 1652 hbebfgwa.exe Token: SeSecurityPrivilege 1652 hbebfgwa.exe Token: SeTakeOwnershipPrivilege 1652 hbebfgwa.exe Token: SeLoadDriverPrivilege 1652 hbebfgwa.exe Token: SeSystemProfilePrivilege 1652 hbebfgwa.exe Token: SeSystemtimePrivilege 1652 hbebfgwa.exe Token: SeProfSingleProcessPrivilege 1652 hbebfgwa.exe Token: SeIncBasePriorityPrivilege 1652 hbebfgwa.exe Token: SeCreatePagefilePrivilege 1652 hbebfgwa.exe Token: SeCreatePermanentPrivilege 1652 hbebfgwa.exe Token: SeBackupPrivilege 1652 hbebfgwa.exe Token: SeRestorePrivilege 1652 hbebfgwa.exe Token: SeShutdownPrivilege 1652 hbebfgwa.exe Token: SeDebugPrivilege 1652 hbebfgwa.exe Token: SeAuditPrivilege 1652 hbebfgwa.exe Token: SeSystemEnvironmentPrivilege 1652 hbebfgwa.exe Token: SeChangeNotifyPrivilege 1652 hbebfgwa.exe Token: SeRemoteShutdownPrivilege 1652 hbebfgwa.exe Token: SeUndockPrivilege 1652 hbebfgwa.exe Token: SeSyncAgentPrivilege 1652 hbebfgwa.exe Token: SeEnableDelegationPrivilege 1652 hbebfgwa.exe Token: SeManageVolumePrivilege 1652 hbebfgwa.exe Token: SeImpersonatePrivilege 1652 hbebfgwa.exe Token: SeCreateGlobalPrivilege 1652 hbebfgwa.exe Token: SeRestorePrivilege 676 msiexec.exe Token: SeTakeOwnershipPrivilege 676 msiexec.exe Token: SeSecurityPrivilege 676 msiexec.exe Token: SeCreateTokenPrivilege 1652 hbebfgwa.exe Token: SeAssignPrimaryTokenPrivilege 1652 hbebfgwa.exe Token: SeLockMemoryPrivilege 1652 hbebfgwa.exe Token: SeIncreaseQuotaPrivilege 1652 hbebfgwa.exe Token: SeMachineAccountPrivilege 1652 hbebfgwa.exe Token: SeTcbPrivilege 1652 hbebfgwa.exe Token: SeSecurityPrivilege 1652 hbebfgwa.exe Token: SeTakeOwnershipPrivilege 1652 hbebfgwa.exe Token: SeLoadDriverPrivilege 1652 hbebfgwa.exe Token: SeSystemProfilePrivilege 1652 hbebfgwa.exe Token: SeSystemtimePrivilege 1652 hbebfgwa.exe Token: SeProfSingleProcessPrivilege 1652 hbebfgwa.exe Token: SeIncBasePriorityPrivilege 1652 hbebfgwa.exe Token: SeCreatePagefilePrivilege 1652 hbebfgwa.exe Token: SeCreatePermanentPrivilege 1652 hbebfgwa.exe Token: SeBackupPrivilege 1652 hbebfgwa.exe Token: SeRestorePrivilege 1652 hbebfgwa.exe Token: SeShutdownPrivilege 1652 hbebfgwa.exe Token: SeDebugPrivilege 1652 hbebfgwa.exe Token: SeAuditPrivilege 1652 hbebfgwa.exe Token: SeSystemEnvironmentPrivilege 1652 hbebfgwa.exe Token: SeChangeNotifyPrivilege 1652 hbebfgwa.exe Token: SeRemoteShutdownPrivilege 1652 hbebfgwa.exe Token: SeUndockPrivilege 1652 hbebfgwa.exe Token: SeSyncAgentPrivilege 1652 hbebfgwa.exe Token: SeEnableDelegationPrivilege 1652 hbebfgwa.exe Token: SeManageVolumePrivilege 1652 hbebfgwa.exe Token: SeImpersonatePrivilege 1652 hbebfgwa.exe Token: SeCreateGlobalPrivilege 1652 hbebfgwa.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1652 hbebfgwa.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1652 1924 Mto-Medical-Review-Form.exe 27 PID 1924 wrote to memory of 1652 1924 Mto-Medical-Review-Form.exe 27 PID 1924 wrote to memory of 1652 1924 Mto-Medical-Review-Form.exe 27 PID 1924 wrote to memory of 1652 1924 Mto-Medical-Review-Form.exe 27 PID 1924 wrote to memory of 1652 1924 Mto-Medical-Review-Form.exe 27 PID 1924 wrote to memory of 1652 1924 Mto-Medical-Review-Form.exe 27 PID 1924 wrote to memory of 1652 1924 Mto-Medical-Review-Form.exe 27 PID 1924 wrote to memory of 1292 1924 Mto-Medical-Review-Form.exe 28 PID 1924 wrote to memory of 1292 1924 Mto-Medical-Review-Form.exe 28 PID 1924 wrote to memory of 1292 1924 Mto-Medical-Review-Form.exe 28 PID 676 wrote to memory of 2032 676 msiexec.exe 30 PID 676 wrote to memory of 2032 676 msiexec.exe 30 PID 676 wrote to memory of 2032 676 msiexec.exe 30 PID 676 wrote to memory of 2032 676 msiexec.exe 30 PID 676 wrote to memory of 2032 676 msiexec.exe 30 PID 676 wrote to memory of 2032 676 msiexec.exe 30 PID 676 wrote to memory of 2032 676 msiexec.exe 30 PID 1292 wrote to memory of 976 1292 Mto-Medical-Review-Form.exe 31 PID 1292 wrote to memory of 976 1292 Mto-Medical-Review-Form.exe 31 PID 1292 wrote to memory of 976 1292 Mto-Medical-Review-Form.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mto-Medical-Review-Form.exe"C:\Users\Admin\AppData\Local\Temp\Mto-Medical-Review-Form.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\hbebfgwa.exe"C:\Users\Admin\AppData\Local\Temp\hbebfgwa.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\Mto-Medical-Review-Form.exe"C:\Users\Admin\AppData\Local\Temp\Mto-Medical-Review-Form.exe" /h2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1292 -s 5883⤵
- Program crash
PID:976
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DB03B754C25F91270F435ED73285A086 C2⤵
- Loads dropped DLL
PID:2032
-