Analysis
-
max time kernel
4s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 11:17
Static task
static1
Behavioral task
behavioral1
Sample
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe
Resource
win10v2004-20220414-en
General
-
Target
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe
-
Size
904KB
-
MD5
174dd7939ab780f7cf8118f9a8967afe
-
SHA1
4fb8476faa85c3ba287c170ebd749331488be2f1
-
SHA256
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4
-
SHA512
918b267890e2befea1abc78643338acd9edbf0c40bc3edcba293278425c41cf3f80eaa4c507bf7802b3c69afa64e9e411842bf9848877a235d2b70fb3e1f4958
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exepid process 1360 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Loads dropped DLL 2 IoCs
Processes:
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exepid process 1640 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe 1640 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe" ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription ioc process File opened for modification \??\PhysicalDrive0 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription pid process target process PID 1640 wrote to memory of 1360 1640 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe PID 1640 wrote to memory of 1360 1640 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe PID 1640 wrote to memory of 1360 1640 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe PID 1640 wrote to memory of 1360 1640 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe PID 1360 wrote to memory of 952 1360 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe schtasks.exe PID 1360 wrote to memory of 952 1360 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe schtasks.exe PID 1360 wrote to memory of 952 1360 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe schtasks.exe PID 1360 wrote to memory of 952 1360 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"C:\Users\Admin\AppData\Local\Temp\ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exeFilesize
150KB
MD5b22a39290f8d3bfa63521368b32b1004
SHA199c2f942b56d1c8fd180d1464f3218bb66cc2016
SHA2561c9c800d28964e7672d59e733c8eba0a262fe1d80cdee042f376927ee296c560
SHA512b9d8cb98028ed01b58e7f7715372e31c647a9e6506119d497668b55f1ab56854b842a7b4f82c9cdff35ccab1ba168d5afe6f161beabdff903c499b27599da7f4
-
\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exeFilesize
150KB
MD5b22a39290f8d3bfa63521368b32b1004
SHA199c2f942b56d1c8fd180d1464f3218bb66cc2016
SHA2561c9c800d28964e7672d59e733c8eba0a262fe1d80cdee042f376927ee296c560
SHA512b9d8cb98028ed01b58e7f7715372e31c647a9e6506119d497668b55f1ab56854b842a7b4f82c9cdff35ccab1ba168d5afe6f161beabdff903c499b27599da7f4
-
\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exeFilesize
150KB
MD5b22a39290f8d3bfa63521368b32b1004
SHA199c2f942b56d1c8fd180d1464f3218bb66cc2016
SHA2561c9c800d28964e7672d59e733c8eba0a262fe1d80cdee042f376927ee296c560
SHA512b9d8cb98028ed01b58e7f7715372e31c647a9e6506119d497668b55f1ab56854b842a7b4f82c9cdff35ccab1ba168d5afe6f161beabdff903c499b27599da7f4
-
memory/952-60-0x0000000000000000-mapping.dmp
-
memory/1360-57-0x0000000000000000-mapping.dmp
-
memory/1640-54-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB