Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 19:04
Static task
static1
Behavioral task
behavioral1
Sample
0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
-
Size
354KB
-
MD5
3a79ab637f283d9f5c69ceb7237ebcfb
-
SHA1
6c79951dff87f8e102571a49c2d7ac7621321d97
-
SHA256
0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85
-
SHA512
e550d50b0d3b78e3b655e02e70f00f08573a89138b86abb98c3a848f149d98cf49f62fd01aeb836f55dc7a05f72fa7dc4d6b22dad7d4c893b88622f6f6167d05
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe -
Deletes itself 1 IoCs
pid Process 860 cmd.exe -
Loads dropped DLL 4 IoCs
pid Process 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 672 taskmgr.exe 672 taskmgr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\Server.exe" 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Roaming\\Default Folder\\Server.exe" 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 456 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe Token: SeDebugPrivilege 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe Token: SeDebugPrivilege 672 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe 672 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1000 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 27 PID 1984 wrote to memory of 1000 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 27 PID 1984 wrote to memory of 1000 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 27 PID 1984 wrote to memory of 1000 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 27 PID 1984 wrote to memory of 860 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 28 PID 1984 wrote to memory of 860 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 28 PID 1984 wrote to memory of 860 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 28 PID 1984 wrote to memory of 860 1984 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 28 PID 1000 wrote to memory of 672 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 30 PID 1000 wrote to memory of 672 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 30 PID 1000 wrote to memory of 672 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 30 PID 1000 wrote to memory of 672 1000 0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe 30 PID 860 wrote to memory of 456 860 cmd.exe 31 PID 860 wrote to memory of 456 860 cmd.exe 31 PID 860 wrote to memory of 456 860 cmd.exe 31 PID 860 wrote to memory of 456 860 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe"C:\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe"C:\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:672
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:456
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
Filesize354KB
MD53a79ab637f283d9f5c69ceb7237ebcfb
SHA16c79951dff87f8e102571a49c2d7ac7621321d97
SHA2560e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85
SHA512e550d50b0d3b78e3b655e02e70f00f08573a89138b86abb98c3a848f149d98cf49f62fd01aeb836f55dc7a05f72fa7dc4d6b22dad7d4c893b88622f6f6167d05
-
C:\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
Filesize354KB
MD53a79ab637f283d9f5c69ceb7237ebcfb
SHA16c79951dff87f8e102571a49c2d7ac7621321d97
SHA2560e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85
SHA512e550d50b0d3b78e3b655e02e70f00f08573a89138b86abb98c3a848f149d98cf49f62fd01aeb836f55dc7a05f72fa7dc4d6b22dad7d4c893b88622f6f6167d05
-
\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
Filesize354KB
MD53a79ab637f283d9f5c69ceb7237ebcfb
SHA16c79951dff87f8e102571a49c2d7ac7621321d97
SHA2560e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85
SHA512e550d50b0d3b78e3b655e02e70f00f08573a89138b86abb98c3a848f149d98cf49f62fd01aeb836f55dc7a05f72fa7dc4d6b22dad7d4c893b88622f6f6167d05
-
\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
Filesize354KB
MD53a79ab637f283d9f5c69ceb7237ebcfb
SHA16c79951dff87f8e102571a49c2d7ac7621321d97
SHA2560e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85
SHA512e550d50b0d3b78e3b655e02e70f00f08573a89138b86abb98c3a848f149d98cf49f62fd01aeb836f55dc7a05f72fa7dc4d6b22dad7d4c893b88622f6f6167d05
-
\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
Filesize354KB
MD53a79ab637f283d9f5c69ceb7237ebcfb
SHA16c79951dff87f8e102571a49c2d7ac7621321d97
SHA2560e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85
SHA512e550d50b0d3b78e3b655e02e70f00f08573a89138b86abb98c3a848f149d98cf49f62fd01aeb836f55dc7a05f72fa7dc4d6b22dad7d4c893b88622f6f6167d05
-
\Users\Admin\AppData\Local\Temp\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85\0e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85.exe
Filesize354KB
MD53a79ab637f283d9f5c69ceb7237ebcfb
SHA16c79951dff87f8e102571a49c2d7ac7621321d97
SHA2560e44d2322791910c8753f89a387dfa576c6bda0c73b5bd62ca689cf10ca96c85
SHA512e550d50b0d3b78e3b655e02e70f00f08573a89138b86abb98c3a848f149d98cf49f62fd01aeb836f55dc7a05f72fa7dc4d6b22dad7d4c893b88622f6f6167d05