Analysis
-
max time kernel
11s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 20:13
Static task
static1
Behavioral task
behavioral1
Sample
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Resource
win7-20220901-en
General
-
Target
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
-
Size
28KB
-
MD5
c1101555cb3e0f55bf293caf6ec27034
-
SHA1
7c44a04dfc1b1ca839044f51b7cec7f918544451
-
SHA256
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4
-
SHA512
b44cbcf8541951834180e77f26e45032937270b87548d2d215b796895057245adbb4ddbfd9ea08e1b85f2f22b9d3f9dfd6987eb3fc2796453bc9a9d202762083
-
SSDEEP
192:QqNKGqvO5JaE9LhHBdb9E9ZhoynJLNgH9Sa2tZch4s9GRmd8MFA93M3pkR:kPEhhdb9whD+d/2tQ4s9Gwd5ASc
Malware Config
Signatures
-
Processes:
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
k4.exek4.exek4.exek4.exepid process 880 k4.exe 896 k4.exe 880 k4.exe 896 k4.exe -
Loads dropped DLL 4 IoCs
Processes:
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exepid process 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe -
Processes:
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1628 taskkill.exe 1628 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
k4.exek4.exedescription pid process Token: SeLoadDriverPrivilege 896 k4.exe Token: SeLoadDriverPrivilege 896 k4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exepid process 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.execmd.exe1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.execmd.exedescription pid process target process PID 1444 wrote to memory of 880 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 880 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 880 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 880 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 896 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 896 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 896 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 896 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 1436 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe cmd.exe PID 1444 wrote to memory of 1436 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe cmd.exe PID 1444 wrote to memory of 1436 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe cmd.exe PID 1444 wrote to memory of 1436 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe cmd.exe PID 1436 wrote to memory of 1628 1436 cmd.exe taskkill.exe PID 1436 wrote to memory of 1628 1436 cmd.exe taskkill.exe PID 1436 wrote to memory of 1628 1436 cmd.exe taskkill.exe PID 1436 wrote to memory of 1628 1436 cmd.exe taskkill.exe PID 1444 wrote to memory of 880 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 880 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 880 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 880 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 896 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 896 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 896 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 896 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe k4.exe PID 1444 wrote to memory of 1436 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe cmd.exe PID 1444 wrote to memory of 1436 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe cmd.exe PID 1444 wrote to memory of 1436 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe cmd.exe PID 1444 wrote to memory of 1436 1444 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe cmd.exe PID 1436 wrote to memory of 1628 1436 cmd.exe taskkill.exe PID 1436 wrote to memory of 1628 1436 cmd.exe taskkill.exe PID 1436 wrote to memory of 1628 1436 cmd.exe taskkill.exe PID 1436 wrote to memory of 1628 1436 cmd.exe taskkill.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe"C:\Users\Admin\AppData\Local\Temp\1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im k4.exe3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe"C:\Users\Admin\AppData\Local\Temp\1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im k4.exe3⤵
- Kills process with taskkill
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\RDSv1.dllFilesize
31KB
MD5f90de519c9a8c75dea55263ba6d15af9
SHA1b80eeb44d0025e9025d055ab68a5fef66e27a623
SHA2563429d3cd36053b6406bb1aa970e52e5dc9d705133fb3edaf19ab8528d374229e
SHA512c5ea29ce32efed5706fcda6de3e839eaa27afb8ac8c8899fe239742fc2e59bc35e68ec72391112176ddbd1114e923fe265fa5915661b823d5a08cc7bb17a193e
-
\Users\Public\Documents\RDSv1.dllFilesize
31KB
MD5f90de519c9a8c75dea55263ba6d15af9
SHA1b80eeb44d0025e9025d055ab68a5fef66e27a623
SHA2563429d3cd36053b6406bb1aa970e52e5dc9d705133fb3edaf19ab8528d374229e
SHA512c5ea29ce32efed5706fcda6de3e839eaa27afb8ac8c8899fe239742fc2e59bc35e68ec72391112176ddbd1114e923fe265fa5915661b823d5a08cc7bb17a193e
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
memory/880-57-0x0000000000000000-mapping.dmp
-
memory/880-59-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmpFilesize
8KB
-
memory/880-59-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmpFilesize
8KB
-
memory/880-57-0x0000000000000000-mapping.dmp
-
memory/896-61-0x0000000000000000-mapping.dmp
-
memory/896-61-0x0000000000000000-mapping.dmp
-
memory/1436-64-0x0000000000000000-mapping.dmp
-
memory/1436-64-0x0000000000000000-mapping.dmp
-
memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1628-65-0x0000000000000000-mapping.dmp
-
memory/1628-65-0x0000000000000000-mapping.dmp