Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 23:33
Static task
static1
Behavioral task
behavioral1
Sample
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe
Resource
win10v2004-20220414-en
General
-
Target
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe
-
Size
2.0MB
-
MD5
cbd089fed817ad11f6ad3d2f9731e872
-
SHA1
138eeed3bbce9d86353e125f0022903ea419fe1a
-
SHA256
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20
-
SHA512
c979db0c2332c6c5e9474cc658194fe5a0726a6b310541bb053c72af32882e2acfa44c5609633b5e8008cef51a8a48ea69cf25570e2fb850f6602319dfed5b50
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe\"" 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Drops startup file 2 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe" 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe" 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription pid process target process PID 1948 set thread context of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exepid process 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exedescription pid process Token: SeDebugPrivilege 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 1980 AcroRd32.exe 1980 AcroRd32.exe 1980 AcroRd32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exerundll32.exedescription pid process target process PID 1948 wrote to memory of 1736 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 1736 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 1736 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 1736 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2004 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2004 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2004 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2004 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 1948 wrote to memory of 2008 1948 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe PID 2008 wrote to memory of 240 2008 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe rundll32.exe PID 2008 wrote to memory of 240 2008 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe rundll32.exe PID 2008 wrote to memory of 240 2008 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe rundll32.exe PID 2008 wrote to memory of 240 2008 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe rundll32.exe PID 2008 wrote to memory of 240 2008 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe rundll32.exe PID 2008 wrote to memory of 240 2008 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe rundll32.exe PID 2008 wrote to memory of 240 2008 92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe rundll32.exe PID 240 wrote to memory of 1980 240 rundll32.exe AcroRd32.exe PID 240 wrote to memory of 1980 240 rundll32.exe AcroRd32.exe PID 240 wrote to memory of 1980 240 rundll32.exe AcroRd32.exe PID 240 wrote to memory of 1980 240 rundll32.exe AcroRd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe"C:\Users\Admin\AppData\Local\Temp\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe"1⤵
- Modifies WinLogon for persistence
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe"C:\Users\Admin\AppData\Local\Temp\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe"C:\Users\Admin\AppData\Local\Temp\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe"C:\Users\Admin\AppData\Local\Temp\92ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Windows3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Windows"4⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WindowsFilesize
2.0MB
MD5cbd089fed817ad11f6ad3d2f9731e872
SHA1138eeed3bbce9d86353e125f0022903ea419fe1a
SHA25692ec9a0eaccf10c69c6ecb89398669105ec4fa4c8b7172579381ba586746ec20
SHA512c979db0c2332c6c5e9474cc658194fe5a0726a6b310541bb053c72af32882e2acfa44c5609633b5e8008cef51a8a48ea69cf25570e2fb850f6602319dfed5b50
-
memory/240-347-0x0000000000000000-mapping.dmp
-
memory/1948-54-0x00000000000F0000-0x00000000002F0000-memory.dmpFilesize
2.0MB
-
memory/1948-55-0x00000000003B0000-0x0000000000400000-memory.dmpFilesize
320KB
-
memory/1980-350-0x0000000000000000-mapping.dmp
-
memory/2008-87-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-91-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-62-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-63-0x0000000000429B7E-mapping.dmp
-
memory/2008-65-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-67-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-69-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-71-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-73-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-75-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-77-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-79-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-81-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-83-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-85-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-60-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-89-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-61-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-93-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-95-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-97-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-99-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-101-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-103-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-105-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-107-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-109-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-111-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-113-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-117-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-119-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-115-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-59-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-57-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2008-56-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB