Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20/06/2022, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe
-
Size
1.7MB
-
MD5
651507c29e0b8709747bbc16f0daa05b
-
SHA1
f7c9d203bee8b4266a365ae2667c855f1f70404a
-
SHA256
33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6
-
SHA512
69380fc1b3dc23a7c7ed926da649056600b3731bdbcf6776e0d87a3e38d50d1f84c6f054eb3b9d2f870fae3725b966015e9d29eeb457898cae016c12766fb0c1
Malware Config
Extracted
Family
cryptbot
C2
jugzsh72.top
Signatures
-
Deletes itself 1 IoCs
pid Process 1356 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1284 33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1156 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1284 33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1356 1284 33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe 27 PID 1284 wrote to memory of 1356 1284 33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe 27 PID 1284 wrote to memory of 1356 1284 33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe 27 PID 1284 wrote to memory of 1356 1284 33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe 27 PID 1356 wrote to memory of 1156 1356 cmd.exe 29 PID 1356 wrote to memory of 1156 1356 cmd.exe 29 PID 1356 wrote to memory of 1156 1356 cmd.exe 29 PID 1356 wrote to memory of 1156 1356 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe"C:\Users\Admin\AppData\Local\Temp\33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\KMjCgydo & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\33c3fc18511d4739f5cb682fa0ec461b4d1b5557b1dcb19126f9c349a905beb6.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
PID:1156
-
-