Analysis
-
max time kernel
137s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 20:26
Static task
static1
Behavioral task
behavioral1
Sample
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe
Resource
win7-20220414-en
General
-
Target
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe
-
Size
825KB
-
MD5
91a939ac483d6fc201bce7807ec673d3
-
SHA1
bd8ba0259c9f69636ac5ff284547232e01dbd888
-
SHA256
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
-
SHA512
41f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
Malware Config
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1344-66-0x0000000002540000-0x00000000025D0000-memory.dmp MailPassView behavioral1/memory/1344-69-0x00000000773F0000-0x0000000077570000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1344-66-0x0000000002540000-0x00000000025D0000-memory.dmp WebBrowserPassView behavioral1/memory/1344-69-0x00000000773F0000-0x0000000077570000-memory.dmp WebBrowserPassView -
Nirsoft 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1344-66-0x0000000002540000-0x00000000025D0000-memory.dmp Nirsoft behavioral1/memory/1344-69-0x00000000773F0000-0x0000000077570000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 2044 Windows Update.exe 1712 Windows Update.exe -
Loads dropped DLL 8 IoCs
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeWindows Update.exeWindows Update.exepid process 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2044 Windows Update.exe 2044 Windows Update.exe 2044 Windows Update.exe 2044 Windows Update.exe 1712 Windows Update.exe 1712 Windows Update.exe 1712 Windows Update.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeWindows Update.exedescription pid process target process PID 1992 set thread context of 1344 1992 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 2044 set thread context of 1712 2044 Windows Update.exe Windows Update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeWindows Update.exepid process 1992 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2044 Windows Update.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exepid process 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeWindows Update.exedescription pid process target process PID 1992 wrote to memory of 1344 1992 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 1992 wrote to memory of 1344 1992 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 1992 wrote to memory of 1344 1992 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 1992 wrote to memory of 1344 1992 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 1344 wrote to memory of 2044 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 1344 wrote to memory of 2044 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 1344 wrote to memory of 2044 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 1344 wrote to memory of 2044 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 1344 wrote to memory of 2044 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 1344 wrote to memory of 2044 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 1344 wrote to memory of 2044 1344 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 2044 wrote to memory of 1712 2044 Windows Update.exe Windows Update.exe PID 2044 wrote to memory of 1712 2044 Windows Update.exe Windows Update.exe PID 2044 wrote to memory of 1712 2044 Windows Update.exe Windows Update.exe PID 2044 wrote to memory of 1712 2044 Windows Update.exe Windows Update.exe PID 2044 wrote to memory of 1712 2044 Windows Update.exe Windows Update.exe PID 2044 wrote to memory of 1712 2044 Windows Update.exe Windows Update.exe PID 2044 wrote to memory of 1712 2044 Windows Update.exe Windows Update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe"C:\Users\Admin\AppData\Local\Temp\2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeC:\Users\Admin\AppData\Local\Temp\2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe"2⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeC:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
memory/1344-70-0x00000000773F0000-0x0000000077570000-memory.dmpFilesize
1.5MB
-
memory/1344-69-0x00000000773F0000-0x0000000077570000-memory.dmpFilesize
1.5MB
-
memory/1344-66-0x0000000002540000-0x00000000025D0000-memory.dmpFilesize
576KB
-
memory/1344-76-0x00000000773F0000-0x0000000077570000-memory.dmpFilesize
1.5MB
-
memory/1344-77-0x00000000745C0000-0x0000000074B6B000-memory.dmpFilesize
5.7MB
-
memory/1344-63-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1344-71-0x00000000745C0000-0x0000000074B6B000-memory.dmpFilesize
5.7MB
-
memory/1344-58-0x00000000004AEF5B-mapping.dmp
-
memory/1712-85-0x00000000004AEF5B-mapping.dmp
-
memory/1992-59-0x00000000773F0000-0x0000000077570000-memory.dmpFilesize
1.5MB
-
memory/1992-57-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1992-56-0x0000000000310000-0x0000000000318000-memory.dmpFilesize
32KB
-
memory/2044-88-0x00000000773F0000-0x0000000077570000-memory.dmpFilesize
1.5MB
-
memory/2044-73-0x0000000000000000-mapping.dmp