b13d767ec9489f7a673f11048a0bf0638385e41a99e3535cb2fcd5fbbd7e09ea

Analysis

max time kernel
117s
max time network
18s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/09/2022, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 230KB
Sample220930-cwvt8acda4
SHA256 b13d767ec9489f7a673f11048a0bf0638385e41a99e3535cb2fcd5fbbd7e09ea
MD5 7d214fb7a7ca0f4a5e09bda093167769
SHA1 1146bdd6c823250f8ec282446547376cd9a32e94
SHA512 81452560540fc5be7e1995ad30ac8c205c55557a0a3f5145a94fd646a85aae0128b1cc571cfd010b911d99aeb627e8e5ab7c391fbae70c8c4c73a991559e40ad
SSDEEP 6144:Zf9agWvFXUJ9nNRD+takclWh1VkP/XfF:Zf9aguFXUfnN9G4s1VkX9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1844	Cleaner.exe

Loads dropped DLL 1 IoCs

pid	Process
1540	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	1844	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1048	file.exe
1048	file.exe
1048	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	Cleaner.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1540	1048	file.exe	29
PID 1048 wrote to memory of 1540	1048	file.exe	29
PID 1048 wrote to memory of 1540	1048	file.exe	29
PID 1048 wrote to memory of 1540	1048	file.exe	29
PID 1540 wrote to memory of 1844	1540	cmd.exe	31
PID 1540 wrote to memory of 1844	1540	cmd.exe	31
PID 1540 wrote to memory of 1844	1540	cmd.exe	31
PID 1540 wrote to memory of 1844	1540	cmd.exe	31
PID 1844 wrote to memory of 2000	1844	Cleaner.exe	33
PID 1844 wrote to memory of 2000	1844	Cleaner.exe	33
PID 1844 wrote to memory of 2000	1844	Cleaner.exe	33

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\Q7gKIeygOc\Cleaner.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\Q7gKIeygOc\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\Q7gKIeygOc\Cleaner.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1844 -s 1156
      4⤵
      Program crash
      PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-56-0x00000000005A0000-0x00000000005DF000-memory.dmp

Download

memory/1048-57-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/1048-55-0x000000000028B000-0x00000000002B2000-memory.dmp

Download

memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmp

Download

memory/1048-70-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/1048-67-0x000000000028B000-0x00000000002B2000-memory.dmp

Download

memory/1048-68-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/1844-64-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Download

memory/1844-66-0x0000000000500000-0x0000000000542000-memory.dmp

Download

memory/1844-63-0x0000000000130000-0x0000000000288000-memory.dmp

Download