Analysis
-
max time kernel
136s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
19/09/2022, 20:17
General
-
Target
06ddea2636416706b0465622e88e8056fe73c3c43dcf80748e35ff9d1e5361b6.exe
-
Size
97KB
-
MD5
b42e9fd553c56d237b7f4108fd3a300b
-
SHA1
5d4c5f97bccc014c301f2b8e60991944c0b9fe4d
-
SHA256
06ddea2636416706b0465622e88e8056fe73c3c43dcf80748e35ff9d1e5361b6
-
SHA512
d93b6527a47899bb6edf056f6078971ec9706d30c99e22697a6a043461f1193ca6d89591ea7dae9f289c2a3ec098fe3adb320e1e8bd686e263cece8546ba957b
-
SSDEEP
1536:k2QVxKF0WN7VU5igbxGyAjsA8uNayVulLDvr1RH7pnGjLjx/QkqMG7:3Yjo7VZ+NAjfpVulLDjbILjx/QkqMA
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 3 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06ddea2636416706b0465622e88e8056fe73c3c43dcf80748e35ff9d1e5361b6.exe"C:\Users\Admin\AppData\Local\Temp\06ddea2636416706b0465622e88e8056fe73c3c43dcf80748e35ff9d1e5361b6.exe"1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\08b9494b.bat" "2⤵
- Deletes itself
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding1⤵
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
303B
MD52a06e4dcb92bde1099f198b4ac0defac
SHA10f58e9c997298c88e7e4c6cd7228c985358dddee
SHA2566566b9f6476d449c528a2ab6bbf0cc07ac8c93b23cbe2172aec0b6d8d84d47c2
SHA5122c6f0a375fffc38fc431125aee530a315448a355a6a3aa7392f79412596f4008ed30f6eeb45c01435bf0492aa2fb11095e1925a5d3615ffce96377efdd380e7c
-
Filesize
25KB
MD5aa506e559f4c2f1f48a2050304c36ca4
SHA139b17e9691a554954c1098e776c6f18326c62b34
SHA256fe89d9c3e872db0ab6b197d2809b614de61eac14eeaee685d5095ba9b8f8178f
SHA512feb11b759277edb136610bdf862cb476abf2332990d6baca6d3b11654be1a23437ffc2f29a97794853f1bd4770102ec3ebac45db36516a3cdb71bcb78b362737
-
Filesize
97KB
MD532b239250caac2b742653e9de5fa807a
SHA1e85633f19920732e71905c30348b986e8dcf78b2
SHA256ade51fe4578bfd39bbf2a5a3163c04e364c7b8cb1c5351b015eb65157fc2f77a
SHA512040cbcdf98bdd4040488b0e6304c160ed9703f66d42636d104a0959a69f6b7ac867e902f7e47a1566b05fe7e73fecf239b254658841858595cbe6b315bc38cee
-
Filesize
25KB
MD5aa506e559f4c2f1f48a2050304c36ca4
SHA139b17e9691a554954c1098e776c6f18326c62b34
SHA256fe89d9c3e872db0ab6b197d2809b614de61eac14eeaee685d5095ba9b8f8178f
SHA512feb11b759277edb136610bdf862cb476abf2332990d6baca6d3b11654be1a23437ffc2f29a97794853f1bd4770102ec3ebac45db36516a3cdb71bcb78b362737
-
Filesize
8KB
-
Filesize
64.0MB
-
Filesize
384KB
-
Filesize
64.0MB
-
Filesize
384KB
-
Filesize
384KB