c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
12/06/2022, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4825e7df93d8acb3dd236cc14c342a71.exe
Size 1.9MB
Sample220612-rdtxjaeddm
SHA256 c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e
MD5 4825e7df93d8acb3dd236cc14c342a71
SHA1 5cc72cdde2d55a8c5e01ccd80cbb5743bc60ca1b
SHA512 a2e8aa90a719cdddb2f9a4fb21b43f6471cb06e0cb94bd041f26b6a4e11bd820a04c5ea832bb899a91db73d7114b046834afe788d6c03d71b1bf6697272de591
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1736	DllHelper.exe

Loads dropped DLL 2 IoCs

pid	Process
1844	4825e7df93d8acb3dd236cc14c342a71.exe
1844	4825e7df93d8acb3dd236cc14c342a71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1380	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1708	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1844	4825e7df93d8acb3dd236cc14c342a71.exe
1844	4825e7df93d8acb3dd236cc14c342a71.exe
1844	4825e7df93d8acb3dd236cc14c342a71.exe
1844	4825e7df93d8acb3dd236cc14c342a71.exe
1844	4825e7df93d8acb3dd236cc14c342a71.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1380	1844	4825e7df93d8acb3dd236cc14c342a71.exe	27
PID 1844 wrote to memory of 1380	1844	4825e7df93d8acb3dd236cc14c342a71.exe	27
PID 1844 wrote to memory of 1380	1844	4825e7df93d8acb3dd236cc14c342a71.exe	27
PID 1844 wrote to memory of 1380	1844	4825e7df93d8acb3dd236cc14c342a71.exe	27
PID 1844 wrote to memory of 1736	1844	4825e7df93d8acb3dd236cc14c342a71.exe	29
PID 1844 wrote to memory of 1736	1844	4825e7df93d8acb3dd236cc14c342a71.exe	29
PID 1844 wrote to memory of 1736	1844	4825e7df93d8acb3dd236cc14c342a71.exe	29
PID 1844 wrote to memory of 1736	1844	4825e7df93d8acb3dd236cc14c342a71.exe	29
PID 1844 wrote to memory of 1700	1844	4825e7df93d8acb3dd236cc14c342a71.exe	30
PID 1844 wrote to memory of 1700	1844	4825e7df93d8acb3dd236cc14c342a71.exe	30
PID 1844 wrote to memory of 1700	1844	4825e7df93d8acb3dd236cc14c342a71.exe	30
PID 1844 wrote to memory of 1700	1844	4825e7df93d8acb3dd236cc14c342a71.exe	30
PID 1700 wrote to memory of 1068	1700	cmd.exe	32
PID 1700 wrote to memory of 1068	1700	cmd.exe	32
PID 1700 wrote to memory of 1068	1700	cmd.exe	32
PID 1700 wrote to memory of 1068	1700	cmd.exe	32
PID 1700 wrote to memory of 1708	1700	cmd.exe	33
PID 1700 wrote to memory of 1708	1700	cmd.exe	33
PID 1700 wrote to memory of 1708	1700	cmd.exe	33
PID 1700 wrote to memory of 1708	1700	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\4825e7df93d8acb3dd236cc14c342a71.exe
"C:\Users\Admin\AppData\Local\Temp\4825e7df93d8acb3dd236cc14c342a71.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\AppVerif\DllHelper.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1380
- C:\Users\Admin\AppVerif\DllHelper.exe
  "C:\Users\Admin\AppVerif\DllHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\4825e7df93d8acb3dd236cc14c342a71.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1068
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DllHelper.exe

Path C:\Users\Admin\AppVerif\DllHelper.exe
Size 104.5MB
SHA256 29727be71f08e62481bcdff215e1fd11e7dcdcd87618255f1e12a9325384662e
MD5 4679d22671dca4f6ddf3ef8cdf0d0603
SHA1 abeb70912e6d0e5d762898e8538a2c4a5500ded7
SHA512 de8abf4d49b73f356c14156f860bf195f9c8d876f2429bf6db2b2bd2f2c81ef9e8160eb5d13e72552225199c2a6062274eec748f76b0857169b709e4f445ce48
SSDEEP 24576:Ware5SMXhd8zlKNfn6LQrmq4Ku0a7ttoXJZ4pt+NfCgPc52L6cnPmJ9C7CnzpCrQ:WvgTW0uNmJPCrjTpM5B3L/q0vlU426
MD5 SHA1 SHA512 SSDEEP

Submit Download

DllHelper.exe

Path \Users\Admin\AppVerif\DllHelper.exe
Size 111.4MB
SHA256 44d85750fc41879299f4a7872d1fe1aab7b0e8f372c1422f0e84e0678bb14ea4
MD5 036a0fed247f57a3f75ccd3c1c4727b5
SHA1 c366a305d50299918c92a01914205b6ed84f09dc
SHA512 b1129c5ca62b159672d7cf2ce3430bb0d55d56afd99f0ec99270e7f4978a0974bd9caad8bc65cd81afd130794d20789610395680dde0fe54d567f99e7ecdb6e5
SSDEEP 24576:Ware5SMXhd8zlKNfn6LQrmq4Ku0a7ttoXJZ4pt+NfCgPc52L6cnPmJ9C7CnzpCrQ:WvgTW0uNmJPCrjTpM5B3L/q0vlU426
MD5 SHA1 SHA512 SSDEEP

Submit Download

DllHelper.exe

Path \Users\Admin\AppVerif\DllHelper.exe
Size 104.1MB
SHA256 54dad6cde5564fcfa5d196c608604d59310e44ddfdacddaf52e68179b9a1d78a
MD5 695128d4f5fd4b0583c65387d6ce765e
SHA1 79327dec29208c38886c8fbdf3c78b7470a5582f
SHA512 f43595147e1af7d8fd461c653f6db5a90bf2a008839b024761cabf9da057a7f2a043b7ae60726a4c0ef4e3712775001fdc80535ec59314ef02fc5c6190a53754
SSDEEP 24576:Ware5SMXhd8zlKNfn6LQrmq4Ku0a7ttoXJZ4pt+NfCgPc52L6cnPmJ9C7CnzpCrQ:WvgTW0uNmJPCrjTpM5B3L/q0vlU426
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1736-64-0x0000000000A00000-0x0000000000B9F000-memory.dmp

Download

memory/1736-66-0x0000000000A00000-0x0000000000B9F000-memory.dmp

Download

memory/1844-54-0x0000000000A20000-0x0000000000BBF000-memory.dmp

Download

memory/1844-57-0x0000000075261000-0x0000000075263000-memory.dmp

Download

memory/1844-65-0x0000000000A20000-0x0000000000BBF000-memory.dmp

Download

memory/1844-56-0x0000000000A20000-0x0000000000BBF000-memory.dmp

Download

memory/1844-55-0x0000000000A20000-0x0000000000BBF000-memory.dmp

Download