Analysis
-
max time kernel
149s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-05-2022 22:29
Static task
static1
Behavioral task
behavioral1
Sample
7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe
Resource
win7-20220414-en
General
-
Target
7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe
-
Size
1.3MB
-
MD5
8f83cdb6e2b59fd44ec017d706ba0cfb
-
SHA1
bae3855ba40c2c9854d357c335a79a41242ea92e
-
SHA256
7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce
-
SHA512
23397905fa31dc0701389c8b6127f271f4dafb23a6e7ac64e594bd366b3dcc16ade37fbef9bbcb3d5d560b2ba1e192696034cf9a3dc7ef92634cac8796815675
Malware Config
Signatures
-
Kutaki Executable 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000400000001e54f-135.dat family_kutaki behavioral2/files/0x000400000001e54f-136.dat family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
sygveych.exepid Process 452 sygveych.exe -
Drops startup file 2 IoCs
Processes:
7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sygveych.exe 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sygveych.exe 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exesygveych.exepid Process 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 452 sygveych.exe 452 sygveych.exe 452 sygveych.exe 452 sygveych.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exedescription pid Process procid_target PID 3676 wrote to memory of 4604 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 84 PID 3676 wrote to memory of 4604 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 84 PID 3676 wrote to memory of 4604 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 84 PID 3676 wrote to memory of 452 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 88 PID 3676 wrote to memory of 452 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 88 PID 3676 wrote to memory of 452 3676 7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe"C:\Users\Admin\AppData\Local\Temp\7c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:4604
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sygveych.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sygveych.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:452
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD58f83cdb6e2b59fd44ec017d706ba0cfb
SHA1bae3855ba40c2c9854d357c335a79a41242ea92e
SHA2567c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce
SHA51223397905fa31dc0701389c8b6127f271f4dafb23a6e7ac64e594bd366b3dcc16ade37fbef9bbcb3d5d560b2ba1e192696034cf9a3dc7ef92634cac8796815675
-
Filesize
1.3MB
MD58f83cdb6e2b59fd44ec017d706ba0cfb
SHA1bae3855ba40c2c9854d357c335a79a41242ea92e
SHA2567c60245a65725dc1b28bf82709a4b292b729586da6a86ff9091cde5059b4a4ce
SHA51223397905fa31dc0701389c8b6127f271f4dafb23a6e7ac64e594bd366b3dcc16ade37fbef9bbcb3d5d560b2ba1e192696034cf9a3dc7ef92634cac8796815675