Analysis
-
max time kernel
177s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2022 13:11
Behavioral task
behavioral1
Sample
42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
General
-
Target
42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe
-
Size
298KB
-
MD5
243d7b4337da35d8f4090e7382e49b74
-
SHA1
162d798a1c60da2733f801b42dd1c845f53a22c9
-
SHA256
42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266
-
SHA512
8ac7f3bbc22f0a933aa62f7cc4394bdccd8c306eed292b34767fb937f1bb052941e903259c91434fba5000903f155c0058a9ef1a0a7402dc1452884c90ce2653
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYE:v6Wq4aaE6KwyF5L0Y2D1PqLf
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 1768 svhost.exe -
resource yara_rule behavioral2/memory/1436-132-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1436-133-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x0008000000022e50-135.dat upx behavioral2/files/0x0008000000022e50-136.dat upx behavioral2/memory/1768-137-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1768-138-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1436-139-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\f: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1436-133-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1768-137-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1768-138-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1436-139-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1768 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1768 svhost.exe 1768 svhost.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1768 svhost.exe 1768 svhost.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1768 svhost.exe 1768 svhost.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1768 svhost.exe 1768 svhost.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe 1768 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1436 wrote to memory of 1768 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 80 PID 1436 wrote to memory of 1768 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 80 PID 1436 wrote to memory of 1768 1436 42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe"C:\Users\Admin\AppData\Local\Temp\42c0d510cdfa459431b44bed505ebfb2a54901ebc745758a77f41daee72d8266.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1768
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5bfaeb61fbfe23f4c7ec0669138b68c4c
SHA1b71fbca2d9197657296f939cf13f1a6431836dce
SHA2566662ca8620cb8c1ee7186ff53e0cc6c3de34f9443dc1140e689ae8b815f3a63d
SHA512f5ac3fa001493d1df9bb09b9907ccf7f6f18ae12247df83c1b75db02f0bfaaaa1487eda504c49f1936727edd22761d5e9144c320f8c9e53c51e2dd44a0ae360f
-
Filesize
298KB
MD5bfaeb61fbfe23f4c7ec0669138b68c4c
SHA1b71fbca2d9197657296f939cf13f1a6431836dce
SHA2566662ca8620cb8c1ee7186ff53e0cc6c3de34f9443dc1140e689ae8b815f3a63d
SHA512f5ac3fa001493d1df9bb09b9907ccf7f6f18ae12247df83c1b75db02f0bfaaaa1487eda504c49f1936727edd22761d5e9144c320f8c9e53c51e2dd44a0ae360f