Overview
overview
10Static
static
107zS8A52FD1...f3.exe
windows7_x64
87zS8A52FD1...f3.exe
windows10-2004_x64
87zS8A52FD1...62.exe
windows7_x64
77zS8A52FD1...62.exe
windows10-2004_x64
77zS8A52FD1...9a.exe
windows7_x64
107zS8A52FD1...9a.exe
windows10-2004_x64
107zS8A52FD1...8a.exe
windows7_x64
107zS8A52FD1...8a.exe
windows10-2004_x64
107zS8A52FD1...f5.exe
windows7_x64
17zS8A52FD1...f5.exe
windows10-2004_x64
17zS8A52FD1...68.exe
windows7_x64
77zS8A52FD1...68.exe
windows10-2004_x64
77zS8A52FD1...41.exe
windows7_x64
77zS8A52FD1...41.exe
windows10-2004_x64
77zS8A52FD1...cd.exe
windows7_x64
87zS8A52FD1...cd.exe
windows10-2004_x64
87zS8A52FD1...71.exe
windows7_x64
57zS8A52FD1...71.exe
windows10-2004_x64
57zS8A52FD1...9c.exe
windows7_x64
107zS8A52FD1...9c.exe
windows10-2004_x64
107zS8A52FD1...0d.exe
windows7_x64
17zS8A52FD1...0d.exe
windows10-2004_x64
17zS8A52FD1...ff.exe
windows7_x64
107zS8A52FD1...ff.exe
windows10-2004_x64
107zS8A52FD1...68.exe
windows7_x64
107zS8A52FD1...68.exe
windows10-2004_x64
107zS8A52FD1...-1.dll
windows7_x64
37zS8A52FD1...-1.dll
windows10-2004_x64
37zS8A52FD1...-6.dll
windows7_x64
37zS8A52FD1...-6.dll
windows10-2004_x64
37zS8A52FD1...-1.dll
windows7_x64
17zS8A52FD1...-1.dll
windows10-2004_x64
1Analysis
-
max time kernel
159s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09-06-2022 14:12
Behavioral task
behavioral1
Sample
7zS8A52FD1B/62a1ea227dc1c_17ee33ef3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
7zS8A52FD1B/62a1ea227dc1c_17ee33ef3.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
7zS8A52FD1B/62a1ea23342ae_c77562.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
7zS8A52FD1B/62a1ea23342ae_c77562.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
7zS8A52FD1B/62a1ea23da745_6e68c9a.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
7zS8A52FD1B/62a1ea23da745_6e68c9a.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
7zS8A52FD1B/62a1ea243386e_a4f8a5d8a.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
7zS8A52FD1B/62a1ea243386e_a4f8a5d8a.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
7zS8A52FD1B/62a1ea2501f48_0371f5.exe
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
7zS8A52FD1B/62a1ea2501f48_0371f5.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
7zS8A52FD1B/62a1ea2a20759_b7a66dc968.exe
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
7zS8A52FD1B/62a1ea2a20759_b7a66dc968.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
7zS8A52FD1B/62a1ea2b65292_c4804f5141.exe
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
7zS8A52FD1B/62a1ea2b65292_c4804f5141.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
7zS8A52FD1B/62a1ea2d09364_3056ccd.exe
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
7zS8A52FD1B/62a1ea2d09364_3056ccd.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
7zS8A52FD1B/62a1ea2df066e_add786971.exe
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
7zS8A52FD1B/62a1ea2df066e_add786971.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
7zS8A52FD1B/62a1ea2f0beee_36a9ec29c.exe
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
7zS8A52FD1B/62a1ea2f0beee_36a9ec29c.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
7zS8A52FD1B/62a1ea2fb0309_1d35870d.exe
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
7zS8A52FD1B/62a1ea2fb0309_1d35870d.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
7zS8A52FD1B/62a1ea319013f_e64e1ff.exe
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
7zS8A52FD1B/62a1ea319013f_e64e1ff.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
7zS8A52FD1B/62a1ea3215fd5_67a668.exe
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
7zS8A52FD1B/62a1ea3215fd5_67a668.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
7zS8A52FD1B/libgcc_s_dw2-1.dll
Resource
win7-20220414-en
Behavioral task
behavioral28
Sample
7zS8A52FD1B/libgcc_s_dw2-1.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral29
Sample
7zS8A52FD1B/libstdc++-6.dll
Resource
win7-20220414-en
Behavioral task
behavioral30
Sample
7zS8A52FD1B/libstdc++-6.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral31
Sample
7zS8A52FD1B/libwinpthread-1.dll
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
7zS8A52FD1B/libwinpthread-1.dll
Resource
win10v2004-20220414-en
General
-
Target
7zS8A52FD1B/62a1ea2a20759_b7a66dc968.exe
-
Size
1.6MB
-
MD5
c4bc22a23300c3e7db1fae03e00610a5
-
SHA1
0f8d2471d510434d0338fa204c7863a5a6e17190
-
SHA256
d866f133333b259ea1aaaa838bd6f26a28798d440ce4531cd90b0497ea92d869
-
SHA512
fa629c9f18ff2cfd07c4da7065a544d84b4dc823c8b542863525eafcf9ad62a74f5f1fdbd6e1f0609135f258b0ffe01b136b614e8bd0d669d0a5ea4052bd3fc6
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
Processes:
rundll32.exerundll32.exepid process 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
62a1ea2a20759_b7a66dc968.execontrol.exerundll32.exeRunDll32.exedescription pid process target process PID 956 wrote to memory of 1248 956 62a1ea2a20759_b7a66dc968.exe control.exe PID 956 wrote to memory of 1248 956 62a1ea2a20759_b7a66dc968.exe control.exe PID 956 wrote to memory of 1248 956 62a1ea2a20759_b7a66dc968.exe control.exe PID 956 wrote to memory of 1248 956 62a1ea2a20759_b7a66dc968.exe control.exe PID 1248 wrote to memory of 2016 1248 control.exe rundll32.exe PID 1248 wrote to memory of 2016 1248 control.exe rundll32.exe PID 1248 wrote to memory of 2016 1248 control.exe rundll32.exe PID 1248 wrote to memory of 2016 1248 control.exe rundll32.exe PID 1248 wrote to memory of 2016 1248 control.exe rundll32.exe PID 1248 wrote to memory of 2016 1248 control.exe rundll32.exe PID 1248 wrote to memory of 2016 1248 control.exe rundll32.exe PID 2016 wrote to memory of 1944 2016 rundll32.exe RunDll32.exe PID 2016 wrote to memory of 1944 2016 rundll32.exe RunDll32.exe PID 2016 wrote to memory of 1944 2016 rundll32.exe RunDll32.exe PID 2016 wrote to memory of 1944 2016 rundll32.exe RunDll32.exe PID 1944 wrote to memory of 1632 1944 RunDll32.exe rundll32.exe PID 1944 wrote to memory of 1632 1944 RunDll32.exe rundll32.exe PID 1944 wrote to memory of 1632 1944 RunDll32.exe rundll32.exe PID 1944 wrote to memory of 1632 1944 RunDll32.exe rundll32.exe PID 1944 wrote to memory of 1632 1944 RunDll32.exe rundll32.exe PID 1944 wrote to memory of 1632 1944 RunDll32.exe rundll32.exe PID 1944 wrote to memory of 1632 1944 RunDll32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2a20759_b7a66dc968.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2a20759_b7a66dc968.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" .\PHF_.hT2⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\PHF_.hT3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\PHF_.hT4⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\PHF_.hT5⤵
- Loads dropped DLL
PID:1632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PHF_.hTFilesize
111.8MB
MD5a051dcd2b1aab0316530154569fa9d91
SHA1d6c8680327921745ecc2e2b067de980e99fec685
SHA256f7b40e2f6fc1a463d14d00d9da0549b224476b7cc9a632786c225180dee36a3b
SHA512def9b4c3f7c20c4fe044f6a93ba266fd1da6bfeebbe26c181efaa23b593cdd6c8961958ae69afae62b8517c905c265ecf8981493c3ce1634d34611113ced4d6d
-
\Users\Admin\AppData\Local\Temp\phF_.hTFilesize
111.8MB
MD5a051dcd2b1aab0316530154569fa9d91
SHA1d6c8680327921745ecc2e2b067de980e99fec685
SHA256f7b40e2f6fc1a463d14d00d9da0549b224476b7cc9a632786c225180dee36a3b
SHA512def9b4c3f7c20c4fe044f6a93ba266fd1da6bfeebbe26c181efaa23b593cdd6c8961958ae69afae62b8517c905c265ecf8981493c3ce1634d34611113ced4d6d
-
\Users\Admin\AppData\Local\Temp\phF_.hTFilesize
111.8MB
MD5a051dcd2b1aab0316530154569fa9d91
SHA1d6c8680327921745ecc2e2b067de980e99fec685
SHA256f7b40e2f6fc1a463d14d00d9da0549b224476b7cc9a632786c225180dee36a3b
SHA512def9b4c3f7c20c4fe044f6a93ba266fd1da6bfeebbe26c181efaa23b593cdd6c8961958ae69afae62b8517c905c265ecf8981493c3ce1634d34611113ced4d6d
-
\Users\Admin\AppData\Local\Temp\phF_.hTFilesize
111.8MB
MD5a051dcd2b1aab0316530154569fa9d91
SHA1d6c8680327921745ecc2e2b067de980e99fec685
SHA256f7b40e2f6fc1a463d14d00d9da0549b224476b7cc9a632786c225180dee36a3b
SHA512def9b4c3f7c20c4fe044f6a93ba266fd1da6bfeebbe26c181efaa23b593cdd6c8961958ae69afae62b8517c905c265ecf8981493c3ce1634d34611113ced4d6d
-
\Users\Admin\AppData\Local\Temp\phF_.hTFilesize
111.8MB
MD5a051dcd2b1aab0316530154569fa9d91
SHA1d6c8680327921745ecc2e2b067de980e99fec685
SHA256f7b40e2f6fc1a463d14d00d9da0549b224476b7cc9a632786c225180dee36a3b
SHA512def9b4c3f7c20c4fe044f6a93ba266fd1da6bfeebbe26c181efaa23b593cdd6c8961958ae69afae62b8517c905c265ecf8981493c3ce1634d34611113ced4d6d
-
\Users\Admin\AppData\Local\Temp\phF_.hTFilesize
111.8MB
MD5a051dcd2b1aab0316530154569fa9d91
SHA1d6c8680327921745ecc2e2b067de980e99fec685
SHA256f7b40e2f6fc1a463d14d00d9da0549b224476b7cc9a632786c225180dee36a3b
SHA512def9b4c3f7c20c4fe044f6a93ba266fd1da6bfeebbe26c181efaa23b593cdd6c8961958ae69afae62b8517c905c265ecf8981493c3ce1634d34611113ced4d6d
-
\Users\Admin\AppData\Local\Temp\phF_.hTFilesize
111.8MB
MD5a051dcd2b1aab0316530154569fa9d91
SHA1d6c8680327921745ecc2e2b067de980e99fec685
SHA256f7b40e2f6fc1a463d14d00d9da0549b224476b7cc9a632786c225180dee36a3b
SHA512def9b4c3f7c20c4fe044f6a93ba266fd1da6bfeebbe26c181efaa23b593cdd6c8961958ae69afae62b8517c905c265ecf8981493c3ce1634d34611113ced4d6d
-
memory/956-54-0x00000000763E1000-0x00000000763E3000-memory.dmpFilesize
8KB
-
memory/1248-55-0x0000000000000000-mapping.dmp
-
memory/1632-75-0x000000002D9B0000-0x000000002DA66000-memory.dmpFilesize
728KB
-
memory/1632-69-0x0000000000000000-mapping.dmp
-
memory/1632-77-0x000000002DA70000-0x000000002DB11000-memory.dmpFilesize
644KB
-
memory/1632-79-0x000000002D770000-0x000000002D82D000-memory.dmpFilesize
756KB
-
memory/1632-80-0x000000002D8F0000-0x000000002D9AC000-memory.dmpFilesize
752KB
-
memory/1944-68-0x0000000000000000-mapping.dmp
-
memory/2016-66-0x0000000000880000-0x0000000000921000-memory.dmpFilesize
644KB
-
memory/2016-65-0x0000000000880000-0x0000000000921000-memory.dmpFilesize
644KB
-
memory/2016-64-0x0000000002630000-0x0000000003630000-memory.dmpFilesize
16.0MB
-
memory/2016-57-0x0000000000000000-mapping.dmp
-
memory/2016-81-0x0000000002630000-0x0000000003630000-memory.dmpFilesize
16.0MB