Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-08-2022 06:01
Static task
static1
Behavioral task
behavioral1
Sample
6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe
Resource
win7-20220812-en
General
-
Target
6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe
-
Size
438KB
-
MD5
0c551697d82616d3b1a485eddf0af56f
-
SHA1
40023cac06e70e14c13fbc7b710e87fce5406c61
-
SHA256
6f02ca9fdc2cd216c60c1013dc5bfbca6384ed866e39b033a3c2bf68cdc0b79e
-
SHA512
63a260836f4de87333232c899c8d5351a9db1e338caffbf2f5f577f96bbadac992bc041a623f7b3c1cbfea5af5228060b95725f758b1abf6428e75c17684a9a8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
update.exepid process 2044 update.exe -
Loads dropped DLL 4 IoCs
Processes:
6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exepid process 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
update.exepid process 2044 update.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
update.exedescription pid process Token: SeDebugPrivilege 2044 update.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
update.exepid process 2044 update.exe 2044 update.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exedescription pid process target process PID 1632 wrote to memory of 2044 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe update.exe PID 1632 wrote to memory of 2044 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe update.exe PID 1632 wrote to memory of 2044 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe update.exe PID 1632 wrote to memory of 2044 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe update.exe PID 1632 wrote to memory of 2024 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe cmd.exe PID 1632 wrote to memory of 2024 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe cmd.exe PID 1632 wrote to memory of 2024 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe cmd.exe PID 1632 wrote to memory of 2024 1632 6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe"C:\Users\Admin\AppData\Local\Temp\6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\update.exe"C:\Users\Admin\AppData\Roaming\update.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Discord-Nitro-Generator.bat" "2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Discord-Nitro-Generator.batFilesize
3KB
MD57bc715359db2720d52250539a3000774
SHA1347cff5768cf149573e5db50889f823dda624712
SHA256a5a0d5e79c1f88b6ad650ddfa522f0ace1239cb20d5ee8c077d0dbfd1195914e
SHA5127844b08d6335d7eca718a02998c6a556e4063acd059725a746b805cf42f4c3677e8c9204dbcb5c657e9822a3b7c6049f2fef2dd6b9e73e412bfe0c56673f133f
-
C:\Users\Admin\AppData\Roaming\update.exeFilesize
308KB
MD5ea3b5c344a9a8c382513bf20bd073870
SHA1b11a7f4ffa68e519760ed1f36e0fffd409a70d87
SHA256530abe6bbab9935fc5de06e44f8441421118a27a1a4fe9b29866594c6292e273
SHA512dfd2cce94257eecfc7b6e1268c8f64da602037338bb69f733dc92dca3f94030133357511d5a7c095a10030584475cfdc214d7859b2d7d5b0d67ee6ae288a4484
-
C:\Users\Admin\AppData\Roaming\update.exeFilesize
308KB
MD5ea3b5c344a9a8c382513bf20bd073870
SHA1b11a7f4ffa68e519760ed1f36e0fffd409a70d87
SHA256530abe6bbab9935fc5de06e44f8441421118a27a1a4fe9b29866594c6292e273
SHA512dfd2cce94257eecfc7b6e1268c8f64da602037338bb69f733dc92dca3f94030133357511d5a7c095a10030584475cfdc214d7859b2d7d5b0d67ee6ae288a4484
-
\Users\Admin\AppData\Roaming\update.exeFilesize
308KB
MD5ea3b5c344a9a8c382513bf20bd073870
SHA1b11a7f4ffa68e519760ed1f36e0fffd409a70d87
SHA256530abe6bbab9935fc5de06e44f8441421118a27a1a4fe9b29866594c6292e273
SHA512dfd2cce94257eecfc7b6e1268c8f64da602037338bb69f733dc92dca3f94030133357511d5a7c095a10030584475cfdc214d7859b2d7d5b0d67ee6ae288a4484
-
\Users\Admin\AppData\Roaming\update.exeFilesize
308KB
MD5ea3b5c344a9a8c382513bf20bd073870
SHA1b11a7f4ffa68e519760ed1f36e0fffd409a70d87
SHA256530abe6bbab9935fc5de06e44f8441421118a27a1a4fe9b29866594c6292e273
SHA512dfd2cce94257eecfc7b6e1268c8f64da602037338bb69f733dc92dca3f94030133357511d5a7c095a10030584475cfdc214d7859b2d7d5b0d67ee6ae288a4484
-
\Users\Admin\AppData\Roaming\update.exeFilesize
308KB
MD5ea3b5c344a9a8c382513bf20bd073870
SHA1b11a7f4ffa68e519760ed1f36e0fffd409a70d87
SHA256530abe6bbab9935fc5de06e44f8441421118a27a1a4fe9b29866594c6292e273
SHA512dfd2cce94257eecfc7b6e1268c8f64da602037338bb69f733dc92dca3f94030133357511d5a7c095a10030584475cfdc214d7859b2d7d5b0d67ee6ae288a4484
-
\Users\Admin\AppData\Roaming\update.exeFilesize
308KB
MD5ea3b5c344a9a8c382513bf20bd073870
SHA1b11a7f4ffa68e519760ed1f36e0fffd409a70d87
SHA256530abe6bbab9935fc5de06e44f8441421118a27a1a4fe9b29866594c6292e273
SHA512dfd2cce94257eecfc7b6e1268c8f64da602037338bb69f733dc92dca3f94030133357511d5a7c095a10030584475cfdc214d7859b2d7d5b0d67ee6ae288a4484
-
memory/1632-54-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB
-
memory/2024-62-0x0000000000000000-mapping.dmp
-
memory/2044-59-0x0000000000000000-mapping.dmp
-
memory/2044-64-0x000007FEF3B50000-0x000007FEF4573000-memory.dmpFilesize
10.1MB
-
memory/2044-65-0x000007FEF24E0000-0x000007FEF3576000-memory.dmpFilesize
16.6MB
-
memory/2044-66-0x000007FEFB551000-0x000007FEFB553000-memory.dmpFilesize
8KB
-
memory/2044-67-0x00000000021C6000-0x00000000021E5000-memory.dmpFilesize
124KB
-
memory/2044-68-0x00000000021C6000-0x00000000021E5000-memory.dmpFilesize
124KB