6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049

Analysis

max time kernel
152s
max time network
120s
platform
windows7_x64
resource
win7-20220414-en
submitted
09/06/2022, 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe
Size

605KB
MD5

7b69e3aaba970c25b40fad29a564a0cf
SHA1

6af0a8634ef3003ccbc743c7ed8869ec2c560042
SHA256

6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049
SHA512

bba40d253de3c19f4c2f890c04d7482b0012f872e1198cc03882ccb08be7c0cdca9bf5b3b6a924e7f2ea337d34ee809fd3c10aa12c15bed036d828dea53e0546

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe

Deletes itself 1 IoCs

pid	Process
1840	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe
840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
368	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe
Token: SeDebugPrivilege	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe
Token: SeDebugPrivilege	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1792 wrote to memory of 1704	1792	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	28
PID 1704 wrote to memory of 840	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	30
PID 1704 wrote to memory of 840	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	30
PID 1704 wrote to memory of 840	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	30
PID 1704 wrote to memory of 840	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	30
PID 1704 wrote to memory of 1840	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	31
PID 1704 wrote to memory of 1840	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	31
PID 1704 wrote to memory of 1840	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	31
PID 1704 wrote to memory of 1840	1704	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	31
PID 1840 wrote to memory of 368	1840	cmd.exe	33
PID 1840 wrote to memory of 368	1840	cmd.exe	33
PID 1840 wrote to memory of 368	1840	cmd.exe	33
PID 1840 wrote to memory of 368	1840	cmd.exe	33
PID 840 wrote to memory of 280	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	34
PID 840 wrote to memory of 280	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	34
PID 840 wrote to memory of 280	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	34
PID 840 wrote to memory of 280	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	34
PID 840 wrote to memory of 280	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	34
PID 840 wrote to memory of 280	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	34
PID 840 wrote to memory of 280	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	34
PID 840 wrote to memory of 280	840	6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe	34

C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe
"C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe
  "C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe
    "C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe
      "C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe"
      4⤵
      PID:280
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 1000
      4⤵
      Runs ping.exe
      PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe

Filesize
605KB

MD5
7b69e3aaba970c25b40fad29a564a0cf

SHA1
6af0a8634ef3003ccbc743c7ed8869ec2c560042

SHA256
6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049

SHA512
bba40d253de3c19f4c2f890c04d7482b0012f872e1198cc03882ccb08be7c0cdca9bf5b3b6a924e7f2ea337d34ee809fd3c10aa12c15bed036d828dea53e0546

Download Submit
C:\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe

Filesize
605KB

MD5
7b69e3aaba970c25b40fad29a564a0cf

SHA1
6af0a8634ef3003ccbc743c7ed8869ec2c560042

SHA256
6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049

SHA512
bba40d253de3c19f4c2f890c04d7482b0012f872e1198cc03882ccb08be7c0cdca9bf5b3b6a924e7f2ea337d34ee809fd3c10aa12c15bed036d828dea53e0546

Download Submit
\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe

Filesize
605KB

MD5
7b69e3aaba970c25b40fad29a564a0cf

SHA1
6af0a8634ef3003ccbc743c7ed8869ec2c560042

SHA256
6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049

SHA512
bba40d253de3c19f4c2f890c04d7482b0012f872e1198cc03882ccb08be7c0cdca9bf5b3b6a924e7f2ea337d34ee809fd3c10aa12c15bed036d828dea53e0546

Download Submit
\Users\Admin\AppData\Local\Temp\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049\6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049.exe

Filesize
605KB

MD5
7b69e3aaba970c25b40fad29a564a0cf

SHA1
6af0a8634ef3003ccbc743c7ed8869ec2c560042

SHA256
6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049

SHA512
bba40d253de3c19f4c2f890c04d7482b0012f872e1198cc03882ccb08be7c0cdca9bf5b3b6a924e7f2ea337d34ee809fd3c10aa12c15bed036d828dea53e0546

Download Submit
memory/840-89-0x0000000000467000-0x000000000046C000-memory.dmp

Filesize
20KB

Download
memory/840-87-0x0000000000467000-0x000000000046C000-memory.dmp

Filesize
20KB

Download
memory/840-84-0x0000000000467000-0x000000000046C000-memory.dmp

Filesize
20KB

Download
memory/840-81-0x0000000000467000-0x000000000046C000-memory.dmp

Filesize
20KB

Download
memory/840-80-0x0000000000467000-0x000000000046C000-memory.dmp

Filesize
20KB

Download
memory/840-76-0x00000000013A0000-0x0000000001440000-memory.dmp

Filesize
640KB

Download
memory/1704-61-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-60-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-69-0x0000000004D80000-0x0000000004E2E000-memory.dmp

Filesize
696KB

Download
memory/1704-68-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/1704-67-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-65-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-57-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-62-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-58-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-70-0x00000000004C0000-0x00000000004E8000-memory.dmp

Filesize
160KB

Download
memory/1792-54-0x0000000000BA0000-0x0000000000C40000-memory.dmp

Filesize
640KB

Download
memory/1792-56-0x0000000000360000-0x0000000000378000-memory.dmp

Filesize
96KB

Download
memory/1792-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download