Analysis
-
max time kernel
128s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
23-05-2022 23:57
Static task
static1
Behavioral task
behavioral1
Sample
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe
Resource
win10v2004-20220414-en
General
-
Target
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe
-
Size
235KB
-
MD5
beca53ebe027a5200ae7b0158f2d742b
-
SHA1
1af422f5bd6f4c4ba570fcd4b823c86f675af85b
-
SHA256
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53
-
SHA512
82d92d315b8a2505d4af0590da25dbd78a6f1c8cbc37317dc6963b0e15b88fc935165b6390e29c9221ff2ee86050bf3d6ee6d0bbb6479f7fd501a9a47c92bf80
Malware Config
Extracted
C:\Restore-My-Files.txt
http://decrmbgpvh6kvmti.onion/
http://helpinfh6vj47ift.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Executes dropped EXE 2 IoCs
Processes:
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exepid process 1652 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 1784 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe -
Loads dropped DLL 2 IoCs
Processes:
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exepid process 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe" 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe -
Drops desktop.ini file(s) 12 IoCs
Processes:
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exedescription ioc process File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Music\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Videos\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe File opened for modification C:\Users\Public\Documents\desktop.ini 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exedescription pid process target process PID 1064 set thread context of 1784 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 3 IoCs
Processes:
cmd.execmd.exe57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe\:Zone.Identifier:$DATA 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exedescription pid process Token: SeDebugPrivilege 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exedescription pid process target process PID 1064 wrote to memory of 2044 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe cmd.exe PID 1064 wrote to memory of 2044 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe cmd.exe PID 1064 wrote to memory of 2044 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe cmd.exe PID 1064 wrote to memory of 2044 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe cmd.exe PID 1064 wrote to memory of 2016 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe cmd.exe PID 1064 wrote to memory of 2016 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe cmd.exe PID 1064 wrote to memory of 2016 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe cmd.exe PID 1064 wrote to memory of 2016 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe cmd.exe PID 1064 wrote to memory of 1652 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1652 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1652 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1652 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1784 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1784 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1784 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1784 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1784 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1784 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe PID 1064 wrote to memory of 1784 1064 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe 57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe"C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe"C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe"C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exeFilesize
235KB
MD5beca53ebe027a5200ae7b0158f2d742b
SHA11af422f5bd6f4c4ba570fcd4b823c86f675af85b
SHA25657358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53
SHA51282d92d315b8a2505d4af0590da25dbd78a6f1c8cbc37317dc6963b0e15b88fc935165b6390e29c9221ff2ee86050bf3d6ee6d0bbb6479f7fd501a9a47c92bf80
-
C:\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exeFilesize
235KB
MD5beca53ebe027a5200ae7b0158f2d742b
SHA11af422f5bd6f4c4ba570fcd4b823c86f675af85b
SHA25657358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53
SHA51282d92d315b8a2505d4af0590da25dbd78a6f1c8cbc37317dc6963b0e15b88fc935165b6390e29c9221ff2ee86050bf3d6ee6d0bbb6479f7fd501a9a47c92bf80
-
\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exeFilesize
235KB
MD5beca53ebe027a5200ae7b0158f2d742b
SHA11af422f5bd6f4c4ba570fcd4b823c86f675af85b
SHA25657358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53
SHA51282d92d315b8a2505d4af0590da25dbd78a6f1c8cbc37317dc6963b0e15b88fc935165b6390e29c9221ff2ee86050bf3d6ee6d0bbb6479f7fd501a9a47c92bf80
-
\Users\Admin\AppData\Local\Temp\57358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53.exeFilesize
235KB
MD5beca53ebe027a5200ae7b0158f2d742b
SHA11af422f5bd6f4c4ba570fcd4b823c86f675af85b
SHA25657358385c4878e612c40af007a27ad7c1bfcd106a0fd07237fe5a8e0681bcd53
SHA51282d92d315b8a2505d4af0590da25dbd78a6f1c8cbc37317dc6963b0e15b88fc935165b6390e29c9221ff2ee86050bf3d6ee6d0bbb6479f7fd501a9a47c92bf80
-
memory/1064-58-0x0000000000820000-0x0000000000828000-memory.dmpFilesize
32KB
-
memory/1064-56-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1064-55-0x00000000001E0000-0x000000000020A000-memory.dmpFilesize
168KB
-
memory/1064-61-0x0000000000B40000-0x0000000000B4C000-memory.dmpFilesize
48KB
-
memory/1064-54-0x0000000000DB0000-0x0000000000DF2000-memory.dmpFilesize
264KB
-
memory/1064-60-0x0000000000840000-0x000000000084C000-memory.dmpFilesize
48KB
-
memory/1784-65-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1784-66-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1784-68-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1784-69-0x0000000000409F20-mapping.dmp
-
memory/1784-73-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1784-74-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2016-59-0x0000000000000000-mapping.dmp
-
memory/2044-57-0x0000000000000000-mapping.dmp