189d5c23910cd58759aafae7139b258fc85d6fd588c04e56479d0c05a4dcdffd

Analysis

max time kernel
3s
max time network
4s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/09/2022, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc063812fa41b939bb950a9ed47cc768.exe
Size 76KB
Sample220930-ewc1hsdddk
SHA256 189d5c23910cd58759aafae7139b258fc85d6fd588c04e56479d0c05a4dcdffd
MD5 fc063812fa41b939bb950a9ed47cc768
SHA1 10821d989d81b5ed542b95ffd35d33c5f59159b7
SHA512 d7ada6ea9289b893170bd7160255a202eeb3004d259bfc22905f12f976e3d79d1bee9d67f450257c5df294fe603b6b83b5b74e18d6d5a1dfbd495a01ae40ee07
SSDEEP 768:P3rtHL1uKHMbw0KyJKNhkKqEAq/YDC+ggWo+rWEGmlH6W/mqsBdnmz5BZEyY7t89:fr1RupbQauqK/jhrP/mgnat89
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2016	rundll32.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2016	rundll32.exe	63

Loads dropped DLL 8 IoCs

pid	Process
564	rundll32.exe
564	rundll32.exe
564	rundll32.exe
564	rundll32.exe
564	rundll32.exe
564	rundll32.exe
564	rundll32.exe
564	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{XLQX6PJ4-4X25-V57O-5VP2-UL9976XXQ7LM}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QFHE7RE0-6Q08-A72E-7QD5-XL0578QJH0EK}	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QFHE7RE0-6Q08-A72E-7QD5-XL0578QJH0EK}\1 = "2203"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{XLQX6PJ4-4X25-V57O-5VP2-UL9976XXQ7LM}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QFHE7RE0-6Q08-A72E-7QD5-XL0578QJH0EK}	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QFHE7RE0-6Q08-A72E-7QD5-XL0578QJH0EK}\1 = "2203"	rundll32.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	rundll32.exe
564	rundll32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1684	1884	fc063812fa41b939bb950a9ed47cc768.exe	29
PID 1884 wrote to memory of 1684	1884	fc063812fa41b939bb950a9ed47cc768.exe	29
PID 1884 wrote to memory of 1684	1884	fc063812fa41b939bb950a9ed47cc768.exe	29
PID 1884 wrote to memory of 1684	1884	fc063812fa41b939bb950a9ed47cc768.exe	29
PID 908 wrote to memory of 564	908	rundll32.exe	31
PID 908 wrote to memory of 564	908	rundll32.exe	31
PID 908 wrote to memory of 564	908	rundll32.exe	31
PID 908 wrote to memory of 564	908	rundll32.exe	31
PID 908 wrote to memory of 564	908	rundll32.exe	31
PID 908 wrote to memory of 564	908	rundll32.exe	31
PID 908 wrote to memory of 564	908	rundll32.exe	31
PID 1884 wrote to memory of 1684	1884	fc063812fa41b939bb950a9ed47cc768.exe	62
PID 1884 wrote to memory of 1684	1884	fc063812fa41b939bb950a9ed47cc768.exe	62
PID 1884 wrote to memory of 1684	1884	fc063812fa41b939bb950a9ed47cc768.exe	62
PID 1884 wrote to memory of 1684	1884	fc063812fa41b939bb950a9ed47cc768.exe	62
PID 908 wrote to memory of 564	908	rundll32.exe	64
PID 908 wrote to memory of 564	908	rundll32.exe	64
PID 908 wrote to memory of 564	908	rundll32.exe	64
PID 908 wrote to memory of 564	908	rundll32.exe	64
PID 908 wrote to memory of 564	908	rundll32.exe	64
PID 908 wrote to memory of 564	908	rundll32.exe	64
PID 908 wrote to memory of 564	908	rundll32.exe	64

C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe
"C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe
  "C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe" -h
  2⤵
  PID:1684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WspService
1⤵
PID:1480

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:564

C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe
"C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe
  "C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe" -h
  2⤵
  PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WspService
1⤵
PID:1480

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 16KB
SHA256 8e9f0269cbeb49cb77a8d66ba67548da8ab4e13c17e8b4c91719cd407607e86f
MD5 2c7fbcca7244956e76bb69455ff32703
SHA1 8902f9d41561fb388a7fb6b60d0fdd0a1e51a7b0
SHA512 1d18cb8e3d8ffc15f7387a9a6f79d64ffaedacafa7a2c674e1e12b707c71e7f96afab13c1245f40a15d920f4a37d95ecf40a22c76beba17aafa8b59cfc4b3823
SSDEEP 384:3BiLmqtJgko1q6jZIX5t5GkwT4TmoCM0UrjJ:3BEmpko1xdVT4Td0U/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 16KB
SHA256 8e9f0269cbeb49cb77a8d66ba67548da8ab4e13c17e8b4c91719cd407607e86f
MD5 2c7fbcca7244956e76bb69455ff32703
SHA1 8902f9d41561fb388a7fb6b60d0fdd0a1e51a7b0
SHA512 1d18cb8e3d8ffc15f7387a9a6f79d64ffaedacafa7a2c674e1e12b707c71e7f96afab13c1245f40a15d920f4a37d95ecf40a22c76beba17aafa8b59cfc4b3823
SSDEEP 384:3BiLmqtJgko1q6jZIX5t5GkwT4TmoCM0UrjJ:3BEmpko1xdVT4Td0U/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 9e02e104e1ab52a1c33d650c34d05a641c53e8edd5471c7ee4f68f29c79d62c1
MD5 e2082e7d7eeb4a3d599472a33cbaca24
SHA1 add8cf241e8fa6ec1e18317a7f3972e900dd9ab7
SHA512 ae880716e0a2db43797a55294e101ad92323a0f08443c0337c4abe4d049375821b04b08744889c992b2a01396e89702585e9a3688e6c795e208e3dd594a99e07
SSDEEP 768:ZSD7R43xFiSK6u2oYf45rVGAYvZZ0UtVtnR:8DaTxGrVGxvhtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 9e02e104e1ab52a1c33d650c34d05a641c53e8edd5471c7ee4f68f29c79d62c1
MD5 e2082e7d7eeb4a3d599472a33cbaca24
SHA1 add8cf241e8fa6ec1e18317a7f3972e900dd9ab7
SHA512 ae880716e0a2db43797a55294e101ad92323a0f08443c0337c4abe4d049375821b04b08744889c992b2a01396e89702585e9a3688e6c795e208e3dd594a99e07
SSDEEP 768:ZSD7R43xFiSK6u2oYf45rVGAYvZZ0UtVtnR:8DaTxGrVGxvhtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path \Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 9e02e104e1ab52a1c33d650c34d05a641c53e8edd5471c7ee4f68f29c79d62c1
MD5 e2082e7d7eeb4a3d599472a33cbaca24
SHA1 add8cf241e8fa6ec1e18317a7f3972e900dd9ab7
SHA512 ae880716e0a2db43797a55294e101ad92323a0f08443c0337c4abe4d049375821b04b08744889c992b2a01396e89702585e9a3688e6c795e208e3dd594a99e07
SSDEEP 768:ZSD7R43xFiSK6u2oYf45rVGAYvZZ0UtVtnR:8DaTxGrVGxvhtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path \Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 9e02e104e1ab52a1c33d650c34d05a641c53e8edd5471c7ee4f68f29c79d62c1
MD5 e2082e7d7eeb4a3d599472a33cbaca24
SHA1 add8cf241e8fa6ec1e18317a7f3972e900dd9ab7
SHA512 ae880716e0a2db43797a55294e101ad92323a0f08443c0337c4abe4d049375821b04b08744889c992b2a01396e89702585e9a3688e6c795e208e3dd594a99e07
SSDEEP 768:ZSD7R43xFiSK6u2oYf45rVGAYvZZ0UtVtnR:8DaTxGrVGxvhtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/564-68-0x0000000001FC0000-0x000000000201E000-memory.dmp

Download

memory/564-67-0x0000000001EB0000-0x0000000001FB1000-memory.dmp

Download

memory/564-68-0x0000000001FC0000-0x000000000201E000-memory.dmp

Download

memory/564-67-0x0000000001EB0000-0x0000000001FB1000-memory.dmp

Download

memory/888-75-0x0000000000930000-0x000000000097D000-memory.dmp

Download

memory/888-76-0x0000000002110000-0x0000000002182000-memory.dmp

Download

memory/888-76-0x0000000002110000-0x0000000002182000-memory.dmp

Download

memory/888-75-0x0000000000930000-0x000000000097D000-memory.dmp

Download

memory/1480-79-0x00000000004E0000-0x0000000000552000-memory.dmp

Download

memory/1480-77-0x0000000000120000-0x000000000016D000-memory.dmp

Download

memory/1480-79-0x00000000004E0000-0x0000000000552000-memory.dmp

Download

memory/1480-77-0x0000000000120000-0x000000000016D000-memory.dmp

Download

memory/1480-64-0x0000000000120000-0x000000000016D000-memory.dmp

Download

memory/1480-64-0x0000000000120000-0x000000000016D000-memory.dmp

Download

memory/1480-78-0x00000000004E0000-0x0000000000552000-memory.dmp

Download

memory/1480-78-0x00000000004E0000-0x0000000000552000-memory.dmp

Download

memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmp

Download

memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmp

Download