4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662

Analysis

max time kernel
152s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
Size

130KB
MD5

6b03fd2ead848a8b98e76e01d2211040
SHA1

6ca1eb0fb58b0c4540dd479604ff898a3df7f733
SHA256

4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662
SHA512

079237f628d4f4a944409a2fd5e865674bbd4e34b5576e5fb163a987f60d070f5a632dc7e03f73ebdfb3d4103e0fbab7faef53f0f886e0d5b154f2567e7bc808
SSDEEP

3072:sr+Fu2II+HiXMcI/AKJv7vV9d300JKML5pbHRHKr+FuqII+Hx:/MHD3/AKp7vV9zJKML5pbHPMHx

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
1884	AE 0124 BE.exe
1988	winlogon.exe
2044	winlogon.exe

Loads dropped DLL 4 IoCs

pid	Process
1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
1988	winlogon.exe
1988	winlogon.exe

Drops autorun.inf file 1 TTPs 24 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	D:\Autorun.inf	winlogon.exe
File opened for modification	\??\J:\Autorun.inf	winlogon.exe
File opened for modification	\??\M:\Autorun.inf	winlogon.exe
File opened for modification	\??\V:\Autorun.inf	winlogon.exe
File opened for modification	C:\Autorun.inf	winlogon.exe
File opened for modification	\??\E:\Autorun.inf	winlogon.exe
File opened for modification	\??\I:\Autorun.inf	winlogon.exe
File opened for modification	\??\K:\Autorun.inf	winlogon.exe
File opened for modification	\??\L:\Autorun.inf	winlogon.exe
File opened for modification	\??\P:\Autorun.inf	winlogon.exe
File opened for modification	\??\R:\Autorun.inf	winlogon.exe
File opened for modification	\??\S:\Autorun.inf	winlogon.exe
File opened for modification	\??\T:\Autorun.inf	winlogon.exe
File opened for modification	\??\U:\Autorun.inf	winlogon.exe
File opened for modification	\??\Y:\Autorun.inf	winlogon.exe
File opened for modification	\??\F:\Autorun.inf	winlogon.exe
File opened for modification	\??\H:\Autorun.inf	winlogon.exe
File opened for modification	\??\N:\Autorun.inf	winlogon.exe
File opened for modification	\??\X:\Autorun.inf	winlogon.exe
File opened for modification	\??\Z:\Autorun.inf	winlogon.exe
File opened for modification	\??\G:\Autorun.inf	winlogon.exe
File opened for modification	\??\O:\Autorun.inf	winlogon.exe
File opened for modification	\??\Q:\Autorun.inf	winlogon.exe
File opened for modification	\??\W:\Autorun.inf	winlogon.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Msvbvm60.dll	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
File created	C:\Windows\AE 0124 BE.exe	winlogon.exe
File opened for modification	C:\Windows\Msvbvm60.dll	winlogon.exe
File created	C:\Windows\AE 0124 BE.exe	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
File opened for modification	C:\Windows\AE 0124 BE.exe	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
File opened for modification	C:\Windows\Msvbvm60.dll	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
1988	winlogon.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1884	1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe	28
PID 1976 wrote to memory of 1884	1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe	28
PID 1976 wrote to memory of 1884	1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe	28
PID 1976 wrote to memory of 1884	1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe	28
PID 1976 wrote to memory of 1988	1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe	29
PID 1976 wrote to memory of 1988	1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe	29
PID 1976 wrote to memory of 1988	1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe	29
PID 1976 wrote to memory of 1988	1976	4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe	29
PID 1988 wrote to memory of 2044	1988	winlogon.exe	30
PID 1988 wrote to memory of 2044	1988	winlogon.exe	30
PID 1988 wrote to memory of 2044	1988	winlogon.exe	30
PID 1988 wrote to memory of 2044	1988	winlogon.exe	30

C:\Users\Admin\AppData\Local\Temp\4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe
"C:\Users\Admin\AppData\Local\Temp\4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\AE 0124 BE.exe
  "C:\Windows\AE 0124 BE.exe"
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\SysWOW64\drivers\winlogon.exe
  "C:\Windows\System32\drivers\winlogon.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops autorun.inf file
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\drivers\winlogon.exe
    "C:\Windows\System32\drivers\winlogon.exe"
    3⤵
    - Executes dropped EXE
    PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AE 0124 BE.exe

Filesize
130KB

MD5
6b03fd2ead848a8b98e76e01d2211040

SHA1
6ca1eb0fb58b0c4540dd479604ff898a3df7f733

SHA256
4a2a249cc2af4d04b1377934418a4289db00ec28db4a32e3d82b4cf108ec1662

SHA512
079237f628d4f4a944409a2fd5e865674bbd4e34b5576e5fb163a987f60d070f5a632dc7e03f73ebdfb3d4103e0fbab7faef53f0f886e0d5b154f2567e7bc808

Download Submit
C:\Windows\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
2c9fdc49734bbeec18692d94589b1ffc

SHA1
2f7fd6728da2f2720d3b8cad8c66506e55711316

SHA256
a7b2869ae1ca72c305f450bae9284af8b192d33469347ab2fa39854118ea6342

SHA512
eca39f1e803998d5e1f629e355b0a26cfc3c12ee12228fbbfdbe327e8a914040a2f3eb48fd4c68c2d4745967ad987e8e51577fea6a8bd73f8d435fd833992112

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
2c9fdc49734bbeec18692d94589b1ffc

SHA1
2f7fd6728da2f2720d3b8cad8c66506e55711316

SHA256
a7b2869ae1ca72c305f450bae9284af8b192d33469347ab2fa39854118ea6342

SHA512
eca39f1e803998d5e1f629e355b0a26cfc3c12ee12228fbbfdbe327e8a914040a2f3eb48fd4c68c2d4745967ad987e8e51577fea6a8bd73f8d435fd833992112

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
2c9fdc49734bbeec18692d94589b1ffc

SHA1
2f7fd6728da2f2720d3b8cad8c66506e55711316

SHA256
a7b2869ae1ca72c305f450bae9284af8b192d33469347ab2fa39854118ea6342

SHA512
eca39f1e803998d5e1f629e355b0a26cfc3c12ee12228fbbfdbe327e8a914040a2f3eb48fd4c68c2d4745967ad987e8e51577fea6a8bd73f8d435fd833992112

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
21B

MD5
9cceaa243c5d161e1ce41c7dad1903dd

SHA1
e3da72675df53fffa781d4377d1d62116eafb35b

SHA256
814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

SHA512
af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
2c9fdc49734bbeec18692d94589b1ffc

SHA1
2f7fd6728da2f2720d3b8cad8c66506e55711316

SHA256
a7b2869ae1ca72c305f450bae9284af8b192d33469347ab2fa39854118ea6342

SHA512
eca39f1e803998d5e1f629e355b0a26cfc3c12ee12228fbbfdbe327e8a914040a2f3eb48fd4c68c2d4745967ad987e8e51577fea6a8bd73f8d435fd833992112

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
2c9fdc49734bbeec18692d94589b1ffc

SHA1
2f7fd6728da2f2720d3b8cad8c66506e55711316

SHA256
a7b2869ae1ca72c305f450bae9284af8b192d33469347ab2fa39854118ea6342

SHA512
eca39f1e803998d5e1f629e355b0a26cfc3c12ee12228fbbfdbe327e8a914040a2f3eb48fd4c68c2d4745967ad987e8e51577fea6a8bd73f8d435fd833992112

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
2c9fdc49734bbeec18692d94589b1ffc

SHA1
2f7fd6728da2f2720d3b8cad8c66506e55711316

SHA256
a7b2869ae1ca72c305f450bae9284af8b192d33469347ab2fa39854118ea6342

SHA512
eca39f1e803998d5e1f629e355b0a26cfc3c12ee12228fbbfdbe327e8a914040a2f3eb48fd4c68c2d4745967ad987e8e51577fea6a8bd73f8d435fd833992112

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
2c9fdc49734bbeec18692d94589b1ffc

SHA1
2f7fd6728da2f2720d3b8cad8c66506e55711316

SHA256
a7b2869ae1ca72c305f450bae9284af8b192d33469347ab2fa39854118ea6342

SHA512
eca39f1e803998d5e1f629e355b0a26cfc3c12ee12228fbbfdbe327e8a914040a2f3eb48fd4c68c2d4745967ad987e8e51577fea6a8bd73f8d435fd833992112

Download Submit
memory/1976-56-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads