Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-04-2022 12:54

General

  • Target

    eef638c058f44481d29fb8b763af94001c632cea7b8b801218de99b8a0750ed0.exe

  • Size

    557KB

  • MD5

    a9c69fa0b7a1a2a72928c83bf48cea3e

  • SHA1

    7cf88e28f6a0e12953a89aba86cc1dea8794f27e

  • SHA256

    eef638c058f44481d29fb8b763af94001c632cea7b8b801218de99b8a0750ed0

  • SHA512

    de5e3403104d78951505c03e51c6ae7526612a844ebc4e989d4faf8bf8138fa9f3afcc39d80ac1d224dd1f95dfcd215cb12407273e90dc409e48908417513e5b

Score
8/10
upx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eef638c058f44481d29fb8b763af94001c632cea7b8b801218de99b8a0750ed0.exe
    "C:\Users\Admin\AppData\Local\Temp\eef638c058f44481d29fb8b763af94001c632cea7b8b801218de99b8a0750ed0.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Temp\msconfigs.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Users\Admin\AppData\Local\Temp\msconfigs.exe
        "C:\Users\Admin\AppData\Local\Temp\msconfigs.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\msconfigs.exe" "C:\Users\Admin\AppData\Roaming\msfonts.exe"
          4⤵
            PID:640
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\msfonts.exe"
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1696
            • C:\Users\Admin\AppData\Roaming\msfonts.exe
              "C:\Users\Admin\AppData\Roaming\msfonts.exe"
              5⤵
              • Executes dropped EXE
              • Drops startup file
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1816
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
                6⤵
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1712
                • C:\Users\Admin\AppData\Local\Temp\TZNlVAKZE10zbXRI.exe
                  "C:\Users\Admin\AppData\Local\Temp\TZNlVAKZE10zbXRI.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1896
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
                6⤵
                  PID:640

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\TZNlVAKZE10zbXRI.exe

        Filesize

        5.6MB

        MD5

        82994b5f5726565ab094aca586ca25ac

        SHA1

        5ef88f5e534eefb0dde10cfdce0d977075c40d1a

        SHA256

        f0428acc40b7ec72a6d1409c3adc1f62bead8f0ef9c5ee47d5f92c35e0bc18bc

        SHA512

        23d19fefea22af46425a0d9e0a0470cea9612681e28c43affe0f2a02ee40683cff62c6728cac59a046f962d7a605c6a4ccf0997570b5898d3cfd7b73e1ce73ac

      • C:\Users\Admin\AppData\Roaming\msfonts.exe

        Filesize

        557KB

        MD5

        a9c69fa0b7a1a2a72928c83bf48cea3e

        SHA1

        7cf88e28f6a0e12953a89aba86cc1dea8794f27e

        SHA256

        eef638c058f44481d29fb8b763af94001c632cea7b8b801218de99b8a0750ed0

        SHA512

        de5e3403104d78951505c03e51c6ae7526612a844ebc4e989d4faf8bf8138fa9f3afcc39d80ac1d224dd1f95dfcd215cb12407273e90dc409e48908417513e5b

      • C:\Users\Admin\AppData\Roaming\msfonts.exe

        Filesize

        557KB

        MD5

        a9c69fa0b7a1a2a72928c83bf48cea3e

        SHA1

        7cf88e28f6a0e12953a89aba86cc1dea8794f27e

        SHA256

        eef638c058f44481d29fb8b763af94001c632cea7b8b801218de99b8a0750ed0

        SHA512

        de5e3403104d78951505c03e51c6ae7526612a844ebc4e989d4faf8bf8138fa9f3afcc39d80ac1d224dd1f95dfcd215cb12407273e90dc409e48908417513e5b

      • \Users\Admin\AppData\Local\Temp\TZNlVAKZE10zbXRI.exe

        Filesize

        5.6MB

        MD5

        82994b5f5726565ab094aca586ca25ac

        SHA1

        5ef88f5e534eefb0dde10cfdce0d977075c40d1a

        SHA256

        f0428acc40b7ec72a6d1409c3adc1f62bead8f0ef9c5ee47d5f92c35e0bc18bc

        SHA512

        23d19fefea22af46425a0d9e0a0470cea9612681e28c43affe0f2a02ee40683cff62c6728cac59a046f962d7a605c6a4ccf0997570b5898d3cfd7b73e1ce73ac

      • \Users\Admin\AppData\Local\Temp\TZNlVAKZE10zbXRI.exe

        Filesize

        5.6MB

        MD5

        82994b5f5726565ab094aca586ca25ac

        SHA1

        5ef88f5e534eefb0dde10cfdce0d977075c40d1a

        SHA256

        f0428acc40b7ec72a6d1409c3adc1f62bead8f0ef9c5ee47d5f92c35e0bc18bc

        SHA512

        23d19fefea22af46425a0d9e0a0470cea9612681e28c43affe0f2a02ee40683cff62c6728cac59a046f962d7a605c6a4ccf0997570b5898d3cfd7b73e1ce73ac

      • \Users\Admin\AppData\Local\Temp\TZNlVAKZE10zbXRI.exe

        Filesize

        5.6MB

        MD5

        82994b5f5726565ab094aca586ca25ac

        SHA1

        5ef88f5e534eefb0dde10cfdce0d977075c40d1a

        SHA256

        f0428acc40b7ec72a6d1409c3adc1f62bead8f0ef9c5ee47d5f92c35e0bc18bc

        SHA512

        23d19fefea22af46425a0d9e0a0470cea9612681e28c43affe0f2a02ee40683cff62c6728cac59a046f962d7a605c6a4ccf0997570b5898d3cfd7b73e1ce73ac

      • \Users\Admin\AppData\Local\Temp\TZNlVAKZE10zbXRI.exe

        Filesize

        5.6MB

        MD5

        82994b5f5726565ab094aca586ca25ac

        SHA1

        5ef88f5e534eefb0dde10cfdce0d977075c40d1a

        SHA256

        f0428acc40b7ec72a6d1409c3adc1f62bead8f0ef9c5ee47d5f92c35e0bc18bc

        SHA512

        23d19fefea22af46425a0d9e0a0470cea9612681e28c43affe0f2a02ee40683cff62c6728cac59a046f962d7a605c6a4ccf0997570b5898d3cfd7b73e1ce73ac

      • \Users\Admin\AppData\Roaming\msfonts.exe

        Filesize

        557KB

        MD5

        a9c69fa0b7a1a2a72928c83bf48cea3e

        SHA1

        7cf88e28f6a0e12953a89aba86cc1dea8794f27e

        SHA256

        eef638c058f44481d29fb8b763af94001c632cea7b8b801218de99b8a0750ed0

        SHA512

        de5e3403104d78951505c03e51c6ae7526612a844ebc4e989d4faf8bf8138fa9f3afcc39d80ac1d224dd1f95dfcd215cb12407273e90dc409e48908417513e5b

      • \Users\Admin\AppData\Roaming\msfonts.exe

        Filesize

        557KB

        MD5

        a9c69fa0b7a1a2a72928c83bf48cea3e

        SHA1

        7cf88e28f6a0e12953a89aba86cc1dea8794f27e

        SHA256

        eef638c058f44481d29fb8b763af94001c632cea7b8b801218de99b8a0750ed0

        SHA512

        de5e3403104d78951505c03e51c6ae7526612a844ebc4e989d4faf8bf8138fa9f3afcc39d80ac1d224dd1f95dfcd215cb12407273e90dc409e48908417513e5b

      • memory/640-110-0x0000000000080000-0x00000000000BF000-memory.dmp

        Filesize

        252KB

      • memory/640-115-0x0000000000080000-0x00000000000BF000-memory.dmp

        Filesize

        252KB

      • memory/1712-85-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-86-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-71-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-72-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-74-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-76-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-77-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-78-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-79-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-81-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1712-84-0x00000000753B1000-0x00000000753B3000-memory.dmp

        Filesize

        8KB

      • memory/1756-54-0x0000000000F00000-0x0000000000F92000-memory.dmp

        Filesize

        584KB

      • memory/1756-56-0x00000000004F0000-0x0000000000514000-memory.dmp

        Filesize

        144KB

      • memory/1756-55-0x0000000000250000-0x0000000000270000-memory.dmp

        Filesize

        128KB

      • memory/1816-68-0x0000000000450000-0x0000000000474000-memory.dmp

        Filesize

        144KB

      • memory/1816-70-0x0000000000960000-0x0000000000972000-memory.dmp

        Filesize

        72KB

      • memory/1816-67-0x00000000012B0000-0x0000000001342000-memory.dmp

        Filesize

        584KB

      • memory/2012-60-0x0000000000AB0000-0x0000000000ABC000-memory.dmp

        Filesize

        48KB

      • memory/2012-59-0x0000000000F00000-0x0000000000F92000-memory.dmp

        Filesize

        584KB