Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
10-06-2022 15:37
Static task
static1
Behavioral task
behavioral1
Sample
07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe
Resource
win7-20220414-en
General
-
Target
07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe
-
Size
54KB
-
MD5
7d6fff4ae0c7ffd8d68486d2df914087
-
SHA1
dc65e3e4c4fb12691fa70f964081600adb18a2ae
-
SHA256
07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4
-
SHA512
a71ae0c58978c655141670d65649baab3c9e964936e7a9faa4a31ec95f838e691741dc9d230496de494d3ccd5b39b09482f6b317bff8d00c59ef61c322b6b8c4
Malware Config
Extracted
netdooka
http://93.115.21.45/gtaddress
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
min_id_resolver.exemin_id_resolver.exepid Process 1700 min_id_resolver.exe 1264 min_id_resolver.exe -
Stops running service(s) 3 TTPs
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Avira 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Avira 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe -
Drops file in Program Files directory 2 IoCs
Processes:
cmd.exedescription ioc Process File created C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe cmd.exe File opened for modification C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe cmd.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid Process 1168 sc.exe 1536 sc.exe 1816 sc.exe 1848 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
min_id_resolver.exemin_id_resolver.exedescription pid Process Token: SeDebugPrivilege 1700 min_id_resolver.exe Token: SeDebugPrivilege 1264 min_id_resolver.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exedescription pid Process procid_target PID 480 wrote to memory of 940 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 28 PID 480 wrote to memory of 940 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 28 PID 480 wrote to memory of 940 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 28 PID 480 wrote to memory of 940 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 28 PID 480 wrote to memory of 2032 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 30 PID 480 wrote to memory of 2032 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 30 PID 480 wrote to memory of 2032 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 30 PID 480 wrote to memory of 2032 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 30 PID 480 wrote to memory of 1848 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 32 PID 480 wrote to memory of 1848 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 32 PID 480 wrote to memory of 1848 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 32 PID 480 wrote to memory of 1848 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 32 PID 480 wrote to memory of 1168 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 34 PID 480 wrote to memory of 1168 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 34 PID 480 wrote to memory of 1168 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 34 PID 480 wrote to memory of 1168 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 34 PID 480 wrote to memory of 1536 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 37 PID 480 wrote to memory of 1536 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 37 PID 480 wrote to memory of 1536 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 37 PID 480 wrote to memory of 1536 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 37 PID 480 wrote to memory of 1816 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 39 PID 480 wrote to memory of 1816 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 39 PID 480 wrote to memory of 1816 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 39 PID 480 wrote to memory of 1816 480 07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe"C:\Users\Admin\AppData\Local\Temp\07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe"1⤵
- Checks for any installed AV software in registry
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\PING.EXE"C:\Windows\System32\PING.EXE" 22.61.56.108 -n 42⤵
- Runs ping.exe
PID:940
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\07aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4.exe" "C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe"2⤵
- Drops file in Program Files directory
PID:2032
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create SecureElementDataSrv binpath= "C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe delected"2⤵
- Launches sc.exe
PID:1848
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start SecureElementDataSrv2⤵
- Launches sc.exe
PID:1168
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop SecureElementDataSrv2⤵
- Launches sc.exe
PID:1536
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start SecureElementDataSrv2⤵
- Launches sc.exe
PID:1816
-
-
C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe"C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe" delected1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe"C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe" delected1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1264
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD57d6fff4ae0c7ffd8d68486d2df914087
SHA1dc65e3e4c4fb12691fa70f964081600adb18a2ae
SHA25607aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4
SHA512a71ae0c58978c655141670d65649baab3c9e964936e7a9faa4a31ec95f838e691741dc9d230496de494d3ccd5b39b09482f6b317bff8d00c59ef61c322b6b8c4
-
Filesize
54KB
MD57d6fff4ae0c7ffd8d68486d2df914087
SHA1dc65e3e4c4fb12691fa70f964081600adb18a2ae
SHA25607aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4
SHA512a71ae0c58978c655141670d65649baab3c9e964936e7a9faa4a31ec95f838e691741dc9d230496de494d3ccd5b39b09482f6b317bff8d00c59ef61c322b6b8c4
-
Filesize
54KB
MD57d6fff4ae0c7ffd8d68486d2df914087
SHA1dc65e3e4c4fb12691fa70f964081600adb18a2ae
SHA25607aec94afba94eb3b35ba5b2e74b37553c3c0fed4f6de1fbac61c20dae3f29d4
SHA512a71ae0c58978c655141670d65649baab3c9e964936e7a9faa4a31ec95f838e691741dc9d230496de494d3ccd5b39b09482f6b317bff8d00c59ef61c322b6b8c4