Overview

overview

8

Static

static

CCTV-Tutmak.exe

windows7_x64

8

CCTV-Tutmak.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    138s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15/06/2022, 06:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CCTV-Tutmak.exe
  • Size 3.2MB
  • Sample220615-hkr7vaaccj
  • SHA256 07a775e0ce0b693e7fe1b7b0175b2951f52bef2ae0ca2d150efc0f40079c735a
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CCTV-Tutmak.exe
    "C:\Users\Admin\AppData\Local\Temp\CCTV-Tutmak.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\eyvttwviuhtukjuj.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Users\Admin\AppData\Roaming\Dgsnvdgk.sfx.exe
        Dgsnvdgk.sfx.exe -pkegczfrhfnnnmfzgfawdcsiffmkdhjmbjjonfaHjqsrmbfkhphedbdsgnydgqwngyqbighfnhfvbnjynfksgvoGkv -dC:\Users\Admin\AppData\Roaming
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Users\Admin\AppData\Roaming\Dgsnvdgk.exe
          "C:\Users\Admin\AppData\Roaming\Dgsnvdgk.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2180
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\cctv06092022.mp4"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2044
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2f4 0x49c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4756

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Dgsnvdgk.exe
        • Path C:\Users\Admin\AppData\Roaming\Dgsnvdgk.exe
        • Size 736KB
        • SHA256 b10c06b505d015d293266c8e9305d30088e454987900465d106fc16108456e0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Dgsnvdgk.exe
        • Path C:\Users\Admin\AppData\Roaming\Dgsnvdgk.exe
        • Size 736KB
        • SHA256 b10c06b505d015d293266c8e9305d30088e454987900465d106fc16108456e0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Dgsnvdgk.sfx.exe
        • Path C:\Users\Admin\AppData\Roaming\Dgsnvdgk.sfx.exe
        • Size 1017KB
        • SHA256 144809549567cdfd0a1005f7d3f8426ab9dc1d2cb5e12ce899562246c7f48426
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Dgsnvdgk.sfx.exe
        • Path C:\Users\Admin\AppData\Roaming\Dgsnvdgk.sfx.exe
        • Size 1017KB
        • SHA256 144809549567cdfd0a1005f7d3f8426ab9dc1d2cb5e12ce899562246c7f48426
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cctv06092022.mp4
        • Path C:\Users\Admin\AppData\Roaming\cctv06092022.mp4
        • Size 1.8MB
        • SHA256 fdbcf5a15476a18a400611f309047d5dda8c6540b57bd1dfc1c06f60f13577a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        eyvttwviuhtukjuj.bat
        • Path C:\Users\Admin\AppData\Roaming\eyvttwviuhtukjuj.bat
        • Size 120B
        • SHA256 114b229590d6fc47abe48ba87e4eaa14b60d30c0d0c912af9626ba6d8a2db09e
        • MD5 SHA1 SHA512
        Submit Download

        memory/2180-139-0x0000000000610000-0x00000000006CC000-memory.dmp
        Download

        memory/2180-141-0x00007FF8B6B80000-0x00007FF8B7641000-memory.dmp
        Download

        memory/2180-142-0x00007FF8B6B80000-0x00007FF8B7641000-memory.dmp
        Download