fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4

Analysis

max time kernel
38s
max time network
43s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe
Size

5.4MB
MD5

9443893f08c65fdae127a1c16f8a7600
SHA1

5eefe94a12c0d06b05cfdd6159e5cfe59e3331bf
SHA256

fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4
SHA512

45a01935d3874e3ed73c6b90956191132386424fa248a4f8723ee6d4575109374fb39b169ff3ec41a6e68f36b119d8475f90fc7fe8bec68b1f3082f9f22e7ee8

Score

8^/10

vmprotect

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

2 1880 wscript.exe

flow	pid	process
2	1880	wscript.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1540-55-0x0000000140000000-0x000000014092A000-memory.dmp	vmprotect
behavioral1/memory/1540-65-0x0000000140000000-0x000000014092A000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

2020 systeminfo.exe

pid	process
2020	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe

pid	process
1540	fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe
1540	fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exewscript.execmd.exe

description	pid	process	target process
PID 1540 wrote to memory of 1880	1540	fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe	wscript.exe
PID 1540 wrote to memory of 1880	1540	fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe	wscript.exe
PID 1540 wrote to memory of 1880	1540	fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe	wscript.exe
PID 1880 wrote to memory of 1520	1880	wscript.exe	cmd.exe
PID 1880 wrote to memory of 1520	1880	wscript.exe	cmd.exe
PID 1880 wrote to memory of 1520	1880	wscript.exe	cmd.exe
PID 1520 wrote to memory of 2020	1520	cmd.exe	systeminfo.exe
PID 1520 wrote to memory of 2020	1520	cmd.exe	systeminfo.exe
PID 1520 wrote to memory of 2020	1520	cmd.exe	systeminfo.exe
PID 1880 wrote to memory of 620	1880	wscript.exe	cmd.exe
PID 1880 wrote to memory of 620	1880	wscript.exe	cmd.exe
PID 1880 wrote to memory of 620	1880	wscript.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe
"C:\Users\Admin\AppData\Local\Temp\fc17d82965b92af78c6925ff2e6d966b879e1a623850a9306a5e01ba13c546e4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\3489.tmp\09.vbs
2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c systeminfo>requireAdministrator>\Users\Public\wafe.txt
3⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\system32\systeminfo.exe
systeminfo
4⤵
- Gathers system information
PID:2020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del \Users\Public\wafe.txt
3⤵
PID:620

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3489.tmp\09.vbs
Filesize
949B

MD5
20c04c5c1bd83da4d71f477ba708ccab

SHA1
00ad216b6698298c27ca69ca4703a0accfc4c9b1

SHA256
770fa7b4b88765699bd9aaedb1561748318ef07bbe306c558bc0eb64060c8bb3

SHA512
ed52d4c8b7ee508b5c6e13453c25c54dacc39b09e809aec7c6ecb749ff64aa2a681ab2e33116087cee46ffd9f48dc2a0a5e393ed820eda9ecc16a2d4a3790665

Download Submit
C:\Users\Public\wafe.txt
Filesize
2KB

MD5
c86c1b40a501e778e9fe264d8a4680c6

SHA1
7be6f248a3655838a63a02afb7cf344108f089e6

SHA256
53e35c7e7af31d196d6b520015fc622162268b025549d20b9b8b7b725c55eb08

SHA512
735bdec4cb357161d640e8e8e8fcaeaa5af0b5a8928a2c8eba5cc307992b970ebd897863a24d13df5f5b2d17d10121707fa7cb49d923e6efbec9501fba7709a7

Download Submit
memory/620-64-0x0000000000000000-mapping.dmp

Download
memory/1520-61-0x0000000000000000-mapping.dmp

Download
memory/1540-54-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmp

Filesize
8KB

Download
memory/1540-55-0x0000000140000000-0x000000014092A000-memory.dmp

Filesize
9.2MB

Download
memory/1540-65-0x0000000140000000-0x000000014092A000-memory.dmp

Filesize
9.2MB

Download
memory/1880-58-0x0000000000000000-mapping.dmp

Download
memory/2020-62-0x0000000000000000-mapping.dmp

Download