Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 02:56

General

  • Target

    70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe

  • Size

    412KB

  • MD5

    29b91a8c1b5f6ee2ee190040f9c16977

  • SHA1

    9c74f2f45743e81ffb9d621e801cde2ec9ebb495

  • SHA256

    70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d

  • SHA512

    cd9c0c013339cd1098bc16f65c52a5c12652caaf2b31c9f989cc15c28c3461f8d434930d1e24044fffbe1c14637004317329d1dc1e1cfb0ee3a3de3bbbb6cc08

  • SSDEEP

    12288:6Ev1PnyMvotKR3yDoPMVGHTsqItqaXljnnIbnI6stkArNEXS2cNgbusSMU:6EhI62NWXncNgbusSMU

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 7 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:336
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
      "C:\Users\Admin\AppData\Local\Temp\70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\HQqGkIT8.exe
        C:\Users\Admin\HQqGkIT8.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:696
        • C:\Users\Admin\baimaus.exe
          "C:\Users\Admin\baimaus.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:1716
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del HQqGkIT8.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1096
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1808
      • C:\Users\Admin\2tej.exe
        C:\Users\Admin\2tej.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1108
        • C:\Users\Admin\2tej.exe
          "C:\Users\Admin\2tej.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1912
      • C:\Users\Admin\3tej.exe
        C:\Users\Admin\3tej.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:1036
        • C:\Users\Admin\4tej.exe
          C:\Users\Admin\4tej.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1700
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
          3⤵
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:1460
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1592
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs
      1⤵
        PID:868

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\2tej.exe

        Filesize

        64KB

        MD5

        1b98630662dace204c7a75ac06ab322f

        SHA1

        f2ebc161d140ce66753f49bf505060216996cdd2

        SHA256

        88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

        SHA512

        430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

      • C:\Users\Admin\2tej.exe

        Filesize

        64KB

        MD5

        1b98630662dace204c7a75ac06ab322f

        SHA1

        f2ebc161d140ce66753f49bf505060216996cdd2

        SHA256

        88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

        SHA512

        430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

      • C:\Users\Admin\2tej.exe

        Filesize

        64KB

        MD5

        1b98630662dace204c7a75ac06ab322f

        SHA1

        f2ebc161d140ce66753f49bf505060216996cdd2

        SHA256

        88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

        SHA512

        430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

      • C:\Users\Admin\3tej.exe

        Filesize

        204KB

        MD5

        666d8f00ccb49a2a23b174aa89c06ec2

        SHA1

        150f8e4aa5fbfb0df6f33a44885e46d43e789800

        SHA256

        c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a

        SHA512

        0615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f

      • C:\Users\Admin\3tej.exe

        Filesize

        204KB

        MD5

        666d8f00ccb49a2a23b174aa89c06ec2

        SHA1

        150f8e4aa5fbfb0df6f33a44885e46d43e789800

        SHA256

        c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a

        SHA512

        0615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f

      • C:\Users\Admin\4tej.exe

        Filesize

        44KB

        MD5

        a60c9c8d5563e0004be44141724b18c9

        SHA1

        b48757d94346720a169e1e13f0c58d7607040b84

        SHA256

        98f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d

        SHA512

        bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88

      • C:\Users\Admin\HQqGkIT8.exe

        Filesize

        292KB

        MD5

        f303cad3eb27fbe3210de3ceba0c383a

        SHA1

        2d6ee904f441820825872e6a1c25602bbc3f4fc7

        SHA256

        27ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134

        SHA512

        b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d

      • C:\Users\Admin\HQqGkIT8.exe

        Filesize

        292KB

        MD5

        f303cad3eb27fbe3210de3ceba0c383a

        SHA1

        2d6ee904f441820825872e6a1c25602bbc3f4fc7

        SHA256

        27ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134

        SHA512

        b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d

      • C:\Users\Admin\baimaus.exe

        Filesize

        292KB

        MD5

        8f1e6f0f3c4dc9c019b057fa053473fc

        SHA1

        a7ce767977f620b92fc3838fa7b92bcc4e1d8d34

        SHA256

        8c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7

        SHA512

        dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e

      • C:\Users\Admin\baimaus.exe

        Filesize

        292KB

        MD5

        8f1e6f0f3c4dc9c019b057fa053473fc

        SHA1

        a7ce767977f620b92fc3838fa7b92bcc4e1d8d34

        SHA256

        8c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7

        SHA512

        dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e

      • C:\Windows\system32\consrv.dll

        Filesize

        52KB

        MD5

        6bf2039986af96d98e08824ac6c383fd

        SHA1

        0bb6384656a96943cb427baa92446f987219a02e

        SHA256

        a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

        SHA512

        fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

      • \??\globalroot\systemroot\assembly\temp\@

        Filesize

        2KB

        MD5

        5bfeb2e8781675fa493027678a658687

        SHA1

        e63c9b5ddd2c8bfe126d90fcab60f836849da629

        SHA256

        8dcad125f6075f304625feffa31c506247e9a08731db509844620f04ec139b31

        SHA512

        b43934c9f4b689c391de5c212792e901c0e137d8192938081cec7add695459c134d60df29474fbcb5285ed1319b62095de89147f7710a3f96dec28393f64d2f5

      • \Users\Admin\2tej.exe

        Filesize

        64KB

        MD5

        1b98630662dace204c7a75ac06ab322f

        SHA1

        f2ebc161d140ce66753f49bf505060216996cdd2

        SHA256

        88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

        SHA512

        430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

      • \Users\Admin\2tej.exe

        Filesize

        64KB

        MD5

        1b98630662dace204c7a75ac06ab322f

        SHA1

        f2ebc161d140ce66753f49bf505060216996cdd2

        SHA256

        88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

        SHA512

        430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

      • \Users\Admin\3tej.exe

        Filesize

        204KB

        MD5

        666d8f00ccb49a2a23b174aa89c06ec2

        SHA1

        150f8e4aa5fbfb0df6f33a44885e46d43e789800

        SHA256

        c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a

        SHA512

        0615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f

      • \Users\Admin\3tej.exe

        Filesize

        204KB

        MD5

        666d8f00ccb49a2a23b174aa89c06ec2

        SHA1

        150f8e4aa5fbfb0df6f33a44885e46d43e789800

        SHA256

        c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a

        SHA512

        0615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f

      • \Users\Admin\4tej.exe

        Filesize

        44KB

        MD5

        a60c9c8d5563e0004be44141724b18c9

        SHA1

        b48757d94346720a169e1e13f0c58d7607040b84

        SHA256

        98f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d

        SHA512

        bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88

      • \Users\Admin\4tej.exe

        Filesize

        44KB

        MD5

        a60c9c8d5563e0004be44141724b18c9

        SHA1

        b48757d94346720a169e1e13f0c58d7607040b84

        SHA256

        98f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d

        SHA512

        bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88

      • \Users\Admin\HQqGkIT8.exe

        Filesize

        292KB

        MD5

        f303cad3eb27fbe3210de3ceba0c383a

        SHA1

        2d6ee904f441820825872e6a1c25602bbc3f4fc7

        SHA256

        27ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134

        SHA512

        b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d

      • \Users\Admin\HQqGkIT8.exe

        Filesize

        292KB

        MD5

        f303cad3eb27fbe3210de3ceba0c383a

        SHA1

        2d6ee904f441820825872e6a1c25602bbc3f4fc7

        SHA256

        27ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134

        SHA512

        b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d

      • \Users\Admin\baimaus.exe

        Filesize

        292KB

        MD5

        8f1e6f0f3c4dc9c019b057fa053473fc

        SHA1

        a7ce767977f620b92fc3838fa7b92bcc4e1d8d34

        SHA256

        8c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7

        SHA512

        dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e

      • \Users\Admin\baimaus.exe

        Filesize

        292KB

        MD5

        8f1e6f0f3c4dc9c019b057fa053473fc

        SHA1

        a7ce767977f620b92fc3838fa7b92bcc4e1d8d34

        SHA256

        8c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7

        SHA512

        dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e

      • \Windows\System32\consrv.dll

        Filesize

        52KB

        MD5

        6bf2039986af96d98e08824ac6c383fd

        SHA1

        0bb6384656a96943cb427baa92446f987219a02e

        SHA256

        a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

        SHA512

        fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

      • memory/336-115-0x0000000001F80000-0x0000000001F91000-memory.dmp

        Filesize

        68KB

      • memory/868-138-0x0000000000840000-0x000000000084B000-memory.dmp

        Filesize

        44KB

      • memory/868-137-0x0000000000820000-0x0000000000828000-memory.dmp

        Filesize

        32KB

      • memory/868-136-0x0000000000840000-0x000000000084B000-memory.dmp

        Filesize

        44KB

      • memory/868-135-0x0000000000820000-0x0000000000828000-memory.dmp

        Filesize

        32KB

      • memory/868-133-0x0000000000830000-0x000000000083B000-memory.dmp

        Filesize

        44KB

      • memory/868-129-0x0000000000830000-0x000000000083B000-memory.dmp

        Filesize

        44KB

      • memory/868-125-0x0000000000830000-0x000000000083B000-memory.dmp

        Filesize

        44KB

      • memory/1260-100-0x00000000029F0000-0x00000000029F6000-memory.dmp

        Filesize

        24KB

      • memory/1260-104-0x00000000029F0000-0x00000000029F6000-memory.dmp

        Filesize

        24KB

      • memory/1260-108-0x00000000029F0000-0x00000000029F6000-memory.dmp

        Filesize

        24KB

      • memory/1672-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

        Filesize

        8KB

      • memory/1724-114-0x0000000030670000-0x00000000306A3000-memory.dmp

        Filesize

        204KB

      • memory/1724-99-0x0000000030670000-0x00000000306A3000-memory.dmp

        Filesize

        204KB

      • memory/1724-98-0x0000000000220000-0x000000000024A000-memory.dmp

        Filesize

        168KB

      • memory/1724-113-0x0000000000220000-0x000000000024A000-memory.dmp

        Filesize

        168KB

      • memory/1912-85-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1912-83-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1912-86-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1912-91-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1912-82-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1912-90-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1912-93-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB