Analysis
- max time kernel
133s - max time network
185s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
07/06/2022, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe
- Size 7.1MB
- Sample220607-mvkyqsdfc9
- SHA256 32262e72073b6862659f40053610922812a9dfd9bd6d42fb09eb7bfbf7202fb8
- MD5 a8a626491fdba630d6c658b1ebbedf4f
- SHA1 604da4a89dc851bf958e81bb98c3ba9e47a7ccba
- SHA512 466c01ee6ffa2b27a45386dec8746c21d4b81093ac694fc56e07c30a645f282ba203ee387f5413cbba1c072c3ae53b425b119bfafd9ca87669bb90a902db97f4
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Stops running service(s) 3 TTPs
- Loads dropped DLL 5 IoCs
pid Process 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\security\api-ms-win-crt-runtime-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-namedpipe-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-synch-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-private-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-convert-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-errorhandling-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-handle-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-process-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-time-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\plugin\DreamApslop.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-localization-l1-2-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-multibyte-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\plugin\sqlite3.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-string-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-string-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\ucrtbase.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-console-l1-2-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-processenvironment-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-environment-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\vcruntime140.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-util-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\concrt140.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-math-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-sysinfo-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-utility-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-libraryloader-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-stdio-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\msvcp140.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-console-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-processenvironment-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-runtime-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-errorhandling-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-interlocked-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-crt-process-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-debug-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\concrt140.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\ucrtbase.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-interlocked-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-conio-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-datetime-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\System_Warning.exe 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\vccorlib140.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\system_laungher.exe 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-processthreads-l1-1-1.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-string-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-processthreads-l1-1-1.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-rtlsupport-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-synch-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-rtlsupport-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-synch-l1-2-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-namedpipe-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-console-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-datetime-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-localization-l1-2-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-processthreads-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\NetworkService.exe 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-sysinfo-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-heap-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-file-l2-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-locale-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-file-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-core-timezone-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\NetworkService\api-ms-win-crt-filesystem-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe File created C:\Windows\SysWOW64\security\api-ms-win-core-memory-l1-1-0.dll 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 424 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2988 wrote to memory of 424 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 80 PID 2988 wrote to memory of 424 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 80 PID 2988 wrote to memory of 424 2988 32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe"C:\Users\Admin\AppData\Local\Temp\32262E72073B6862659F40053610922812A9DFD9BD6D42FB09EB7BFBF7202FB8.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\sc.exesc delete SystemSecurityService2⤵
- Launches sc.exe
PID:424
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsvEF38.tmp\InstallOptions.dll
- Size 15KB
- SHA256 f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
- MD5 89351a0a6a89519c86c5531e20dab9ea
- SHA1 9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
- SHA512 13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08
- SSDEEP 384:/MnT0MKT/Xwr2izZQ86mpAT8F9lN8Ov0J:EQMKzwTFnVX8i0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvEF38.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsvEF38.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsvEF38.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsvEF38.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- MD5 SHA1 SHA512