Analysis
-
max time kernel
136s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 19:45
Static task
static1
Behavioral task
behavioral1
Sample
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe
Resource
win10v2004-20220414-en
General
-
Target
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe
-
Size
204KB
-
MD5
015475207d5f3954b4a964ae05030afb
-
SHA1
c82bd3fc33f143f96a7b39b18619de6d7d9c3331
-
SHA256
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590
-
SHA512
51a1eaf1fb647c1e13c3e4d60bdee0b4dc59958127c96f04a6256d96eaab2077fed6359a712b68a8bb72059bffbf528910cfc59bdd6254097b113710905fbc24
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
Processes:
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\75439967573920484\winsvr.exe = "C:\\Users\\Admin\\75439967573920484\\winsvr.exe:*:Enabled:Windows Service" 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe -
Executes dropped EXE 2 IoCs
Processes:
winsvr.exewinsvr.exepid process 2024 winsvr.exe 1728 winsvr.exe -
Loads dropped DLL 2 IoCs
Processes:
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exepid process 1928 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 1928 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\75439967573920484\\winsvr.exe" 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exewinsvr.exedescription pid process target process PID 1980 set thread context of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 2024 set thread context of 1728 2024 winsvr.exe winsvr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exewinsvr.exepid process 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 2024 winsvr.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exewinsvr.exedescription pid process target process PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1980 wrote to memory of 1928 1980 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe PID 1928 wrote to memory of 2024 1928 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe winsvr.exe PID 1928 wrote to memory of 2024 1928 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe winsvr.exe PID 1928 wrote to memory of 2024 1928 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe winsvr.exe PID 1928 wrote to memory of 2024 1928 0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe PID 2024 wrote to memory of 1728 2024 winsvr.exe winsvr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe"C:\Users\Admin\AppData\Local\Temp\0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe"C:\Users\Admin\AppData\Local\Temp\0073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590.exe"2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\75439967573920484\winsvr.exe"C:\Users\Admin\75439967573920484\winsvr.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\75439967573920484\winsvr.exe"C:\Users\Admin\75439967573920484\winsvr.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\75439967573920484\winsvr.exeFilesize
204KB
MD5015475207d5f3954b4a964ae05030afb
SHA1c82bd3fc33f143f96a7b39b18619de6d7d9c3331
SHA2560073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590
SHA51251a1eaf1fb647c1e13c3e4d60bdee0b4dc59958127c96f04a6256d96eaab2077fed6359a712b68a8bb72059bffbf528910cfc59bdd6254097b113710905fbc24
-
C:\Users\Admin\75439967573920484\winsvr.exeFilesize
204KB
MD5015475207d5f3954b4a964ae05030afb
SHA1c82bd3fc33f143f96a7b39b18619de6d7d9c3331
SHA2560073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590
SHA51251a1eaf1fb647c1e13c3e4d60bdee0b4dc59958127c96f04a6256d96eaab2077fed6359a712b68a8bb72059bffbf528910cfc59bdd6254097b113710905fbc24
-
C:\Users\Admin\75439967573920484\winsvr.exeFilesize
204KB
MD5015475207d5f3954b4a964ae05030afb
SHA1c82bd3fc33f143f96a7b39b18619de6d7d9c3331
SHA2560073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590
SHA51251a1eaf1fb647c1e13c3e4d60bdee0b4dc59958127c96f04a6256d96eaab2077fed6359a712b68a8bb72059bffbf528910cfc59bdd6254097b113710905fbc24
-
\Users\Admin\75439967573920484\winsvr.exeFilesize
204KB
MD5015475207d5f3954b4a964ae05030afb
SHA1c82bd3fc33f143f96a7b39b18619de6d7d9c3331
SHA2560073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590
SHA51251a1eaf1fb647c1e13c3e4d60bdee0b4dc59958127c96f04a6256d96eaab2077fed6359a712b68a8bb72059bffbf528910cfc59bdd6254097b113710905fbc24
-
\Users\Admin\75439967573920484\winsvr.exeFilesize
204KB
MD5015475207d5f3954b4a964ae05030afb
SHA1c82bd3fc33f143f96a7b39b18619de6d7d9c3331
SHA2560073dff04251a2a400f5c542630bdf291c341406cb7fdc9b2a411dc633fc2590
SHA51251a1eaf1fb647c1e13c3e4d60bdee0b4dc59958127c96f04a6256d96eaab2077fed6359a712b68a8bb72059bffbf528910cfc59bdd6254097b113710905fbc24
-
memory/1728-91-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1728-90-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1728-86-0x00000000004046F6-mapping.dmp
-
memory/1928-63-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1928-68-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1928-69-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1928-67-0x0000000076C01000-0x0000000076C03000-memory.dmpFilesize
8KB
-
memory/1928-64-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1928-65-0x00000000004046F6-mapping.dmp
-
memory/1928-56-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1928-62-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1928-61-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1928-59-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1928-57-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2024-72-0x0000000000000000-mapping.dmp