Analysis
- max time kernel
152s - max time network
50s - platform
windows7_x64 - resource
win7-20220414-en - submitted
13/07/2022, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
virussign.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
virussign.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target virussign.exe
- Size 738KB
- Sample220713-rnfgwsfbcq
- SHA256 24b97bd8e51250efbf2bd9115924aed5df1c6ca1920c289eb8a340ea78256b30
- MD5 62e6c33ebddc9de4a2f56136857b7a00
- SHA1 c7c762ce627e05c851d9514ae830a550f56c2d03
- SHA512 3d6f27c1be94ea6c00e025ef7104956a871fe4af4690dfbd79e7a258435f91a10b767facc31d140e2a287bf1e315157d763233b1c854fcb254d17fe1e9997c6e
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1980 tcpscrex.exe -
resource yara_rule behavioral1/memory/1904-55-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/files/0x000900000001233f-56.dat upx behavioral1/files/0x000900000001233f-59.dat upx behavioral1/files/0x000900000001233f-58.dat upx behavioral1/files/0x000900000001233f-57.dat upx behavioral1/memory/1904-63-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/files/0x000900000001233f-61.dat upx behavioral1/files/0x000900000001233f-64.dat upx behavioral1/memory/1980-65-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1980-66-0x0000000000400000-0x00000000004B7000-memory.dmp upx - Loads dropped DLL 4 IoCs
pid Process 1904 virussign.exe 1904 virussign.exe 1904 virussign.exe 1904 virussign.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1904-55-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/files/0x000900000001233f-56.dat autoit_exe behavioral1/files/0x000900000001233f-59.dat autoit_exe behavioral1/files/0x000900000001233f-58.dat autoit_exe behavioral1/files/0x000900000001233f-57.dat autoit_exe behavioral1/memory/1904-63-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/files/0x000900000001233f-61.dat autoit_exe behavioral1/files/0x000900000001233f-64.dat autoit_exe behavioral1/memory/1980-65-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1980-66-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Managemenot\Monitor\tcpscrex.exe virussign.exe File opened for modification C:\Program Files\Managemenot\Monitor\tcpscrex.exe virussign.exe File created C:\Program Files (x86)\Activxr\Rescuer.exe tcpscrex.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe 1980 tcpscrex.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1904 wrote to memory of 1980 1904 virussign.exe 29 PID 1904 wrote to memory of 1980 1904 virussign.exe 29 PID 1904 wrote to memory of 1980 1904 virussign.exe 29 PID 1904 wrote to memory of 1980 1904 virussign.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.exe"C:\Users\Admin\AppData\Local\Temp\virussign.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files\Managemenot\Monitor\tcpscrex.exe"C:\Program Files\Managemenot\Monitor\tcpscrex.exe" 0.0.0.02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1980
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 00f8fcb67d74b5d6ae773f31291f840d54cb9ffe9e792910ee83d44a03f2bcca
- MD5 e115217c0e756c9ec5141c813789e861
- SHA1 a30b8401e3a34504daf860efd5ca2781d8719533
- SHA512 cc441a8e1bb95c17dc63336b54b2d2bb89411fe910204354bb5d5632b802647f9e7f7e8850224b4241d28262d4103bf527bcab076febcedcbeeeee45523fdd12
- SSDEEP 12288:haWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:waHMv6Corjqnyz3/06
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 00f8fcb67d74b5d6ae773f31291f840d54cb9ffe9e792910ee83d44a03f2bcca
- MD5 e115217c0e756c9ec5141c813789e861
- SHA1 a30b8401e3a34504daf860efd5ca2781d8719533
- SHA512 cc441a8e1bb95c17dc63336b54b2d2bb89411fe910204354bb5d5632b802647f9e7f7e8850224b4241d28262d4103bf527bcab076febcedcbeeeee45523fdd12
- SSDEEP 12288:haWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:waHMv6Corjqnyz3/06
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 00f8fcb67d74b5d6ae773f31291f840d54cb9ffe9e792910ee83d44a03f2bcca
- MD5 e115217c0e756c9ec5141c813789e861
- SHA1 a30b8401e3a34504daf860efd5ca2781d8719533
- SHA512 cc441a8e1bb95c17dc63336b54b2d2bb89411fe910204354bb5d5632b802647f9e7f7e8850224b4241d28262d4103bf527bcab076febcedcbeeeee45523fdd12
- SSDEEP 12288:haWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:waHMv6Corjqnyz3/06
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 00f8fcb67d74b5d6ae773f31291f840d54cb9ffe9e792910ee83d44a03f2bcca
- MD5 e115217c0e756c9ec5141c813789e861
- SHA1 a30b8401e3a34504daf860efd5ca2781d8719533
- SHA512 cc441a8e1bb95c17dc63336b54b2d2bb89411fe910204354bb5d5632b802647f9e7f7e8850224b4241d28262d4103bf527bcab076febcedcbeeeee45523fdd12
- SSDEEP 12288:haWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:waHMv6Corjqnyz3/06
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 00f8fcb67d74b5d6ae773f31291f840d54cb9ffe9e792910ee83d44a03f2bcca
- MD5 e115217c0e756c9ec5141c813789e861
- SHA1 a30b8401e3a34504daf860efd5ca2781d8719533
- SHA512 cc441a8e1bb95c17dc63336b54b2d2bb89411fe910204354bb5d5632b802647f9e7f7e8850224b4241d28262d4103bf527bcab076febcedcbeeeee45523fdd12
- SSDEEP 12288:haWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:waHMv6Corjqnyz3/06
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 00f8fcb67d74b5d6ae773f31291f840d54cb9ffe9e792910ee83d44a03f2bcca
- MD5 e115217c0e756c9ec5141c813789e861
- SHA1 a30b8401e3a34504daf860efd5ca2781d8719533
- SHA512 cc441a8e1bb95c17dc63336b54b2d2bb89411fe910204354bb5d5632b802647f9e7f7e8850224b4241d28262d4103bf527bcab076febcedcbeeeee45523fdd12
- SSDEEP 12288:haWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:waHMv6Corjqnyz3/06
- MD5 SHA1 SHA512 SSDEEP