Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe
Resource
win10v2004-20220721-en
General
-
Target
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe
-
Size
958KB
-
MD5
510f9e146edd3103ddd4b7da3f6521ee
-
SHA1
affc015f99525fd0884c06812a54af3557331a5e
-
SHA256
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
-
SHA512
b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/952-67-0x0000000000480000-0x0000000000510000-memory.dmp MailPassView behavioral1/memory/952-66-0x0000000000482000-0x000000000050A000-memory.dmp MailPassView behavioral1/memory/952-70-0x0000000077E00000-0x0000000077F80000-memory.dmp MailPassView behavioral1/memory/1568-102-0x00000000009B0000-0x0000000000A40000-memory.dmp MailPassView behavioral1/memory/1568-104-0x0000000077E00000-0x0000000077F80000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/952-67-0x0000000000480000-0x0000000000510000-memory.dmp WebBrowserPassView behavioral1/memory/952-66-0x0000000000482000-0x000000000050A000-memory.dmp WebBrowserPassView behavioral1/memory/952-70-0x0000000077E00000-0x0000000077F80000-memory.dmp WebBrowserPassView behavioral1/memory/1568-102-0x00000000009B0000-0x0000000000A40000-memory.dmp WebBrowserPassView behavioral1/memory/1568-104-0x0000000077E00000-0x0000000077F80000-memory.dmp WebBrowserPassView -
Nirsoft 5 IoCs
Processes:
resource yara_rule behavioral1/memory/952-67-0x0000000000480000-0x0000000000510000-memory.dmp Nirsoft behavioral1/memory/952-66-0x0000000000482000-0x000000000050A000-memory.dmp Nirsoft behavioral1/memory/952-70-0x0000000077E00000-0x0000000077F80000-memory.dmp Nirsoft behavioral1/memory/1568-102-0x00000000009B0000-0x0000000000A40000-memory.dmp Nirsoft behavioral1/memory/1568-104-0x0000000077E00000-0x0000000077F80000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 868 Windows Update.exe 1568 Windows Update.exe -
Deletes itself 1 IoCs
Processes:
Windows Update.exepid process 1568 Windows Update.exe -
Loads dropped DLL 8 IoCs
Processes:
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exeWindows Update.exeWindows Update.exepid process 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe 868 Windows Update.exe 868 Windows Update.exe 868 Windows Update.exe 868 Windows Update.exe 1568 Windows Update.exe 1568 Windows Update.exe 1568 Windows Update.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exeWindows Update.exedescription pid process target process PID 964 set thread context of 952 964 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe PID 868 set thread context of 1568 868 Windows Update.exe Windows Update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exeWindows Update.exepid process 964 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe 868 Windows Update.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exeWindows Update.exepid process 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe 1568 Windows Update.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exeWindows Update.exedescription pid process target process PID 964 wrote to memory of 952 964 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe PID 964 wrote to memory of 952 964 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe PID 964 wrote to memory of 952 964 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe PID 964 wrote to memory of 952 964 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe PID 952 wrote to memory of 868 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe Windows Update.exe PID 952 wrote to memory of 868 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe Windows Update.exe PID 952 wrote to memory of 868 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe Windows Update.exe PID 952 wrote to memory of 868 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe Windows Update.exe PID 952 wrote to memory of 868 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe Windows Update.exe PID 952 wrote to memory of 868 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe Windows Update.exe PID 952 wrote to memory of 868 952 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe Windows Update.exe PID 868 wrote to memory of 1568 868 Windows Update.exe Windows Update.exe PID 868 wrote to memory of 1568 868 Windows Update.exe Windows Update.exe PID 868 wrote to memory of 1568 868 Windows Update.exe Windows Update.exe PID 868 wrote to memory of 1568 868 Windows Update.exe Windows Update.exe PID 868 wrote to memory of 1568 868 Windows Update.exe Windows Update.exe PID 868 wrote to memory of 1568 868 Windows Update.exe Windows Update.exe PID 868 wrote to memory of 1568 868 Windows Update.exe Windows Update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exeC:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"2⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeC:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD577e59d559fcd40ef905a3a09bdca6c87
SHA12f36517d4388f4c50fe3f1012d6dee451b5ccef2
SHA2567bb228ee03097c93bcdefca40280a7a7aa9a05e150266c0ec694345fd3a62483
SHA512aaf452fbf90b6382809f6e99a96f471d3f1b735106f4876c3d7070fae70b95791c6a7ac4f7a5475dbdb7a28228587e6f3282397dcca9413a4585f5756fb275b7
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
958KB
MD5510f9e146edd3103ddd4b7da3f6521ee
SHA1affc015f99525fd0884c06812a54af3557331a5e
SHA2565c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231
-
memory/868-85-0x00000000002D0000-0x00000000003BF000-memory.dmpFilesize
956KB
-
memory/868-87-0x0000000077E00000-0x0000000077F80000-memory.dmpFilesize
1.5MB
-
memory/868-74-0x0000000000000000-mapping.dmp
-
memory/868-90-0x0000000077E00000-0x0000000077F80000-memory.dmpFilesize
1.5MB
-
memory/952-70-0x0000000077E00000-0x0000000077F80000-memory.dmpFilesize
1.5MB
-
memory/952-63-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/952-77-0x0000000077E00000-0x0000000077F80000-memory.dmpFilesize
1.5MB
-
memory/952-72-0x0000000074FD0000-0x000000007557B000-memory.dmpFilesize
5.7MB
-
memory/952-71-0x0000000077E00000-0x0000000077F80000-memory.dmpFilesize
1.5MB
-
memory/952-78-0x0000000074FD0000-0x000000007557B000-memory.dmpFilesize
5.7MB
-
memory/952-69-0x00000000067E0000-0x00000000068A1000-memory.dmpFilesize
772KB
-
memory/952-58-0x00000000004D11BD-mapping.dmp
-
memory/952-66-0x0000000000482000-0x000000000050A000-memory.dmpFilesize
544KB
-
memory/952-67-0x0000000000480000-0x0000000000510000-memory.dmpFilesize
576KB
-
memory/964-56-0x00000000003E0000-0x00000000003E7000-memory.dmpFilesize
28KB
-
memory/964-59-0x0000000077E00000-0x0000000077F80000-memory.dmpFilesize
1.5MB
-
memory/964-57-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1568-88-0x00000000004D11BD-mapping.dmp
-
memory/1568-97-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1568-102-0x00000000009B0000-0x0000000000A40000-memory.dmpFilesize
576KB
-
memory/1568-104-0x0000000077E00000-0x0000000077F80000-memory.dmpFilesize
1.5MB
-
memory/1568-105-0x0000000077E00000-0x0000000077F80000-memory.dmpFilesize
1.5MB
-
memory/1568-106-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB