Analysis
- max time kernel
90s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
07/06/2022, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe
- Size 6.7MB
- Sample220607-mt2j4ahfcp
- SHA256 0e45e4518520737de10107dd9f0ef027bc21e3579ded4f3e38e8f92f1e2dd32d
- MD5 41522abc967179ac3e1676c753669f7b
- SHA1 3c45aa0dfcc9013f4835ad3aac6c4819a5181ae9
- SHA512 d61456b6c08475c1b03d9386722a97fcad14897d50acc1efb0d831430b0fa347710d4907bc1da9ecd6290a28a6b8086dd773bc19bfe9f1822153a16c1302e4f8
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Stops running service(s) 3 TTPs
- Loads dropped DLL 4 IoCs
pid Process 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\security\api-ms-win-crt-environment-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-sysinfo-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\concrt140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-filesystem-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-rtlsupport-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-synch-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-file-l2-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-locale-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\concrt140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-process-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-sysinfo-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\vcruntime140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\ca.pem 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-localization-l1-2-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\API-MS-Win-core-xstate-l2-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\ucrtbase.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\vccorlib140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-timezone-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-errorhandling-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-profile-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-math-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-runtime-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-synch-l1-2-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-heap-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-datetime-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\vcruntime140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-console-l1-2-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-processenvironment-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\mfc140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-conio-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-convert-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\msvcp140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-heap-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\vccorlib140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-libraryloader-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-processthreads-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-convert-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-heap-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-string-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\DbgHelp.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-private-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-time-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-namedpipe-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-interlocked-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\API-MS-Win-core-xstate-l2-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-processthreads-l1-1-1.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\SecurityServiceHost.exe 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-libraryloader-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-util-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\browser_broker.exe 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\msvcp140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-file-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-stdio-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\mfc140.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-file-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-conio-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-math-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-handle-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-processthreads-l1-1-1.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-string-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-private-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-crt-environment-l1-1-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\RuntimeBrokerService\api-ms-win-core-file-l1-2-0.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe File created C:\Windows\SysWOW64\security\DbgHelp.dll 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3156 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1620 wrote to memory of 3156 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 80 PID 1620 wrote to memory of 3156 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 80 PID 1620 wrote to memory of 3156 1620 0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe"C:\Users\Admin\AppData\Local\Temp\0E45E4518520737DE10107DD9F0EF027BC21E3579DED4F3E38E8F92F1E2DD32D.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\sc.exesc delete SecurityServiceHost2⤵
- Launches sc.exe
PID:3156
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsi9D9D.tmp\InstallOptions.dll
- Size 15KB
- SHA256 f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
- MD5 89351a0a6a89519c86c5531e20dab9ea
- SHA1 9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
- SHA512 13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08
- SSDEEP 384:/MnT0MKT/Xwr2izZQ86mpAT8F9lN8Ov0J:EQMKzwTFnVX8i0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi9D9D.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi9D9D.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi9D9D.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- MD5 SHA1 SHA512