Overview

overview

10

Static

static

1

575a2d86b2...b4.exe

windows7-x64

10

575a2d86b2...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2022 23:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    575a2d86b2ce4748295486e6e23577115a3865c9599f2f10fd89d295da824cb4.exe

  • Size

    268KB

  • MD5

    0680cff012a9f043fb831ab21244f7ee

  • SHA1

    017a0dd7d4e5ec693a3e20592957b46c3840b7fc

  • SHA256

    575a2d86b2ce4748295486e6e23577115a3865c9599f2f10fd89d295da824cb4

  • SHA512

    770d51eea1194d86882f9e28800a4e0d654ac083e49d5db32fb347ad6e722432be7acb4031468cdcbbe52ad7c90b81fbe3b751055a9a7ef6d8926faa563360f3

Score
10/10
discoveryransomwarespywarestealersuricata

Malware Config

Signatures

  • suricata: ET MALWARE Ransomware/Cerber Checkin 2

    suricata: ET MALWARE Ransomware/Cerber Checkin 2

    suricata
  • suricata: ET MALWARE Ransomware/Cerber Checkin M3 (8)

    suricata: ET MALWARE Ransomware/Cerber Checkin M3 (8)

    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Contacts a large (521) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\575a2d86b2ce4748295486e6e23577115a3865c9599f2f10fd89d295da824cb4.exe
    "C:\Users\Admin\AppData\Local\Temp\575a2d86b2ce4748295486e6e23577115a3865c9599f2f10fd89d295da824cb4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Users\Admin\AppData\Local\Temp\575a2d86b2ce4748295486e6e23577115a3865c9599f2f10fd89d295da824cb4.exe
      "C:\Users\Admin\AppData\Local\Temp\575a2d86b2ce4748295486e6e23577115a3865c9599f2f10fd89d295da824cb4.exe"
      2⤵
      • Modifies extensions of user files
      • Sets desktop wallpaper using registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3448
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Windows\system32\wbem\WMIC.exe
          C:\Windows\system32\wbem\wmic.exe shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1516
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4340
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4b0 0x480
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

1
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Network Service Scanning

1
T1046

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd83CC.tmp\System.dll
    Filesize

    11KB

    MD5

    a436db0c473a087eb61ff5c53c34ba27

    SHA1

    65ea67e424e75f5065132b539c8b2eda88aa0506

    SHA256

    75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    SHA512

    908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsd83CC.tmp\System.dll
    Filesize

    11KB

    MD5

    a436db0c473a087eb61ff5c53c34ba27

    SHA1

    65ea67e424e75f5065132b539c8b2eda88aa0506

    SHA256

    75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    SHA512

    908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\OpenCandy.dll
    Filesize

    102KB

    MD5

    0fcebb9ef2376e8b9d9843c92812fc8b

    SHA1

    7d43d520884acd3fab51efa7343c8cee136a1627

    SHA256

    cf1e175115951204857fdbb970516bfcc45f70648a6077edf189c9995f19fd8a

    SHA512

    232c1c6b7a19e00a3d4bcca212f8a036baa585b1ffb6567a2de5542aad8d2e0add9a4f84efe69de409e16acf3bd5ad16eb2a2b2f5692cb957d72fb7f1e06bde8

    Download Submit
  • C:\Users\Admin\AppData\Roaming\abstract.title.properties.xml
    Filesize

    2KB

    MD5

    6cb16f2c0608a18cebf5be1f8bbe79d2

    SHA1

    557e163b13dd6e76194fab3f3c6c0a32639bbd9c

    SHA256

    332d4e509aa23429fed0e3194d31e818664cb67f22d6e68031cb6183ec438777

    SHA512

    a2fbfffa1dad18abbf4a6ad6797068dae91fcd46d1b76a365e6531a080d55e251641ea8afecc5e8b9fde4dffe756e09b1c37f9724332cf917687432e2386cf9c

    Download Submit
  • memory/1516-140-0x0000000000000000-mapping.dmp
    Download
  • memory/3448-133-0x0000000000000000-mapping.dmp
    Download
  • memory/3448-134-0x0000000000400000-0x0000000000431000-memory.dmp
    Filesize

    196KB

    Download
  • memory/3448-136-0x0000000000400000-0x0000000000431000-memory.dmp
    Filesize

    196KB

    Download
  • memory/3448-137-0x0000000000400000-0x0000000000431000-memory.dmp
    Filesize

    196KB

    Download
  • memory/3448-138-0x0000000000400000-0x0000000000431000-memory.dmp
    Filesize

    196KB

    Download
  • memory/4220-139-0x0000000000000000-mapping.dmp
    Download