Analysis
-
max time kernel
153s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:45
Static task
static1
Behavioral task
behavioral1
Sample
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe
Resource
win10v2004-20220414-en
General
-
Target
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe
-
Size
156KB
-
MD5
155f99e5dd86820942fa5e1f05ae1bbe
-
SHA1
65100fad9ea9e59ece5ac703a0ee60ae8440245c
-
SHA256
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564
-
SHA512
29d0286b6714e32e4d82ececfe9e9730c4c51c76b443291dce0c911b7299664e6e16a58cc833a4f259fa8d432bc66beb2b7d04a0676515a30e5c9d70b11333ad
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
untitled.exepid process 1824 untitled.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
untitled.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b72703673af5d475a624599b0b805a17.exe untitled.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b72703673af5d475a624599b0b805a17.exe untitled.exe -
Loads dropped DLL 1 IoCs
Processes:
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exepid process 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
untitled.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\b72703673af5d475a624599b0b805a17 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\untitled.exe\" .." untitled.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b72703673af5d475a624599b0b805a17 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\untitled.exe\" .." untitled.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exepid process 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exeuntitled.exedescription pid process Token: SeDebugPrivilege 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe Token: SeDebugPrivilege 1824 untitled.exe Token: 33 1824 untitled.exe Token: SeIncBasePriorityPrivilege 1824 untitled.exe Token: 33 1824 untitled.exe Token: SeIncBasePriorityPrivilege 1824 untitled.exe Token: 33 1824 untitled.exe Token: SeIncBasePriorityPrivilege 1824 untitled.exe Token: 33 1824 untitled.exe Token: SeIncBasePriorityPrivilege 1824 untitled.exe Token: 33 1824 untitled.exe Token: SeIncBasePriorityPrivilege 1824 untitled.exe Token: 33 1824 untitled.exe Token: SeIncBasePriorityPrivilege 1824 untitled.exe Token: 33 1824 untitled.exe Token: SeIncBasePriorityPrivilege 1824 untitled.exe Token: 33 1824 untitled.exe Token: SeIncBasePriorityPrivilege 1824 untitled.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exeuntitled.exedescription pid process target process PID 1532 wrote to memory of 1824 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe untitled.exe PID 1532 wrote to memory of 1824 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe untitled.exe PID 1532 wrote to memory of 1824 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe untitled.exe PID 1532 wrote to memory of 1824 1532 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe untitled.exe PID 1824 wrote to memory of 1972 1824 untitled.exe netsh.exe PID 1824 wrote to memory of 1972 1824 untitled.exe netsh.exe PID 1824 wrote to memory of 1972 1824 untitled.exe netsh.exe PID 1824 wrote to memory of 1972 1824 untitled.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe"C:\Users\Admin\AppData\Local\Temp\9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\untitled.exe"C:\Users\Admin\AppData\Local\Temp\untitled.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\untitled.exe" "untitled.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\untitled.exeFilesize
156KB
MD5155f99e5dd86820942fa5e1f05ae1bbe
SHA165100fad9ea9e59ece5ac703a0ee60ae8440245c
SHA2569c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564
SHA51229d0286b6714e32e4d82ececfe9e9730c4c51c76b443291dce0c911b7299664e6e16a58cc833a4f259fa8d432bc66beb2b7d04a0676515a30e5c9d70b11333ad
-
C:\Users\Admin\AppData\Local\Temp\untitled.exeFilesize
156KB
MD5155f99e5dd86820942fa5e1f05ae1bbe
SHA165100fad9ea9e59ece5ac703a0ee60ae8440245c
SHA2569c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564
SHA51229d0286b6714e32e4d82ececfe9e9730c4c51c76b443291dce0c911b7299664e6e16a58cc833a4f259fa8d432bc66beb2b7d04a0676515a30e5c9d70b11333ad
-
\Users\Admin\AppData\Local\Temp\untitled.exeFilesize
156KB
MD5155f99e5dd86820942fa5e1f05ae1bbe
SHA165100fad9ea9e59ece5ac703a0ee60ae8440245c
SHA2569c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564
SHA51229d0286b6714e32e4d82ececfe9e9730c4c51c76b443291dce0c911b7299664e6e16a58cc833a4f259fa8d432bc66beb2b7d04a0676515a30e5c9d70b11333ad
-
memory/1532-54-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1532-55-0x00000000745C0000-0x0000000074B6B000-memory.dmpFilesize
5.7MB
-
memory/1824-57-0x0000000000000000-mapping.dmp
-
memory/1824-61-0x00000000745C0000-0x0000000074B6B000-memory.dmpFilesize
5.7MB
-
memory/1972-62-0x0000000000000000-mapping.dmp