Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-06-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
3f4db4050dee9f3e8bd5e5582c819cf5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3f4db4050dee9f3e8bd5e5582c819cf5.exe
Resource
win10v2004-20220414-en
General
-
Target
3f4db4050dee9f3e8bd5e5582c819cf5.exe
-
Size
2.3MB
-
MD5
3f4db4050dee9f3e8bd5e5582c819cf5
-
SHA1
9791da30a7d8e2370d035d46dc45238daaf79301
-
SHA256
8dae589a1806bcf1cf37a85cf9821a25527c4a271d8aba3c9a8f621061766840
-
SHA512
f748cd3cd36f994977010305c71e6f4eeb611240c7edcb972e29bb7c82c7067715001e492d12975c9e14d38496acb1643e75bb7703f568ab5effe53bd62227dd
Malware Config
Extracted
bitrat
1.38
37.0.11.155:4670
-
communication_password
31af2433c836721a29f5d8e94b790444
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dzueh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Prrmwscy\\Dzueh.exe\"" 3f4db4050dee9f3e8bd5e5582c819cf5.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 1820 InstallUtil.exe 1820 InstallUtil.exe 1820 InstallUtil.exe 1820 InstallUtil.exe 1820 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exedescription pid process target process PID 1416 set thread context of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1300 timeout.exe 1692 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exepid process 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe Token: SeDebugPrivilege 1820 InstallUtil.exe Token: SeShutdownPrivilege 1820 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 1820 InstallUtil.exe 1820 InstallUtil.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.execmd.execmd.exedescription pid process target process PID 1416 wrote to memory of 956 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 1416 wrote to memory of 956 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 1416 wrote to memory of 956 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 1416 wrote to memory of 956 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 956 wrote to memory of 1300 956 cmd.exe timeout.exe PID 956 wrote to memory of 1300 956 cmd.exe timeout.exe PID 956 wrote to memory of 1300 956 cmd.exe timeout.exe PID 956 wrote to memory of 1300 956 cmd.exe timeout.exe PID 1416 wrote to memory of 2040 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 1416 wrote to memory of 2040 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 1416 wrote to memory of 2040 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 1416 wrote to memory of 2040 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 2040 wrote to memory of 1692 2040 cmd.exe timeout.exe PID 2040 wrote to memory of 1692 2040 cmd.exe timeout.exe PID 2040 wrote to memory of 1692 2040 cmd.exe timeout.exe PID 2040 wrote to memory of 1692 2040 cmd.exe timeout.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 1416 wrote to memory of 1820 1416 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f4db4050dee9f3e8bd5e5582c819cf5.exe"C:\Users\Admin\AppData\Local\Temp\3f4db4050dee9f3e8bd5e5582c819cf5.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout /nobreak /t 192⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak /t 193⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 392⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 393⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/956-56-0x0000000000000000-mapping.dmp
-
memory/1300-57-0x0000000000000000-mapping.dmp
-
memory/1416-84-0x0000000072580000-0x000000007390F000-memory.dmpFilesize
19.6MB
-
memory/1416-54-0x0000000000300000-0x0000000000558000-memory.dmpFilesize
2.3MB
-
memory/1416-86-0x0000000071390000-0x0000000071B70000-memory.dmpFilesize
7.9MB
-
memory/1416-59-0x0000000071B70000-0x0000000072580000-memory.dmpFilesize
10.1MB
-
memory/1416-60-0x0000000071390000-0x0000000071B70000-memory.dmpFilesize
7.9MB
-
memory/1416-61-0x0000000005560000-0x00000000057A8000-memory.dmpFilesize
2.3MB
-
memory/1416-62-0x0000000004940000-0x000000000498C000-memory.dmpFilesize
304KB
-
memory/1416-85-0x0000000071B70000-0x0000000072580000-memory.dmpFilesize
10.1MB
-
memory/1416-55-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1416-65-0x0000000073FF0000-0x0000000074184000-memory.dmpFilesize
1.6MB
-
memory/1416-66-0x0000000070670000-0x000000007138D000-memory.dmpFilesize
13.1MB
-
memory/1416-67-0x000000006FF30000-0x000000007066E000-memory.dmpFilesize
7.2MB
-
memory/1416-58-0x0000000072580000-0x000000007390F000-memory.dmpFilesize
19.6MB
-
memory/1692-64-0x0000000000000000-mapping.dmp
-
memory/1820-92-0x00000000000A0000-0x00000000000AA000-memory.dmpFilesize
40KB
-
memory/1820-71-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-75-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-77-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-68-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-80-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-83-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-69-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-78-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-81-0x000000000068A488-mapping.dmp
-
memory/1820-73-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-88-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-89-0x00000000000A0000-0x00000000000AA000-memory.dmpFilesize
40KB
-
memory/1820-90-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1820-91-0x00000000000A0000-0x00000000000AA000-memory.dmpFilesize
40KB
-
memory/2040-63-0x0000000000000000-mapping.dmp