Analysis
-
max time kernel
40s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-06-2022 17:54
Static task
static1
Behavioral task
behavioral1
Sample
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe
Resource
win10v2004-20220414-en
General
-
Target
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe
-
Size
142KB
-
MD5
b7920415a12a7db60121cecf1682c1bd
-
SHA1
d2c4bc48ae40d0479020bc91f8135d14d0deca57
-
SHA256
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808
-
SHA512
1a8930fc137a61decef7a2e3df3e6b477309278a6dae5b14b83d565873456d9987a57613bfa0c3a7a6bc05341207a376b0ffce344cf29db12f3aa385f6635de1
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2000 cmd.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exedescription ioc process File opened for modification \??\PhysicalDrive0 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe -
Drops file in System32 directory 2 IoCs
Processes:
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exedescription ioc process File created C:\Windows\SysWOW64\dllcache\vvvhost.exe 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe File opened for modification C:\Windows\SysWOW64\dllcache\vvvhost.exe 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
Processes:
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exedescription pid process target process PID 1836 wrote to memory of 2000 1836 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe cmd.exe PID 1836 wrote to memory of 2000 1836 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe cmd.exe PID 1836 wrote to memory of 2000 1836 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe cmd.exe PID 1836 wrote to memory of 2000 1836 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe"C:\Users\Admin\AppData\Local\Temp\31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\31CE0D~1.EXE >> NUL2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1836-54-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB
-
memory/1836-55-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1836-56-0x00000000002E0000-0x0000000000310000-memory.dmpFilesize
192KB
-
memory/1836-57-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1836-58-0x00000000002E0000-0x0000000000310000-memory.dmpFilesize
192KB
-
memory/1836-60-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1836-61-0x00000000002E0000-0x0000000000310000-memory.dmpFilesize
192KB
-
memory/2000-59-0x0000000000000000-mapping.dmp