5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93

Analysis

max time kernel
135s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 059420.exe
Size 527KB
Sample221003-qtpgbahdfp
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1636	Host.exe
532	Host.exe
1996	Host.exe
1120	Host.exe

Loads dropped DLL 1 IoCs

pid	Process
524	PO 059420.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 756 set thread context of 524	756	PO 059420.exe	30
PID 1636 set thread context of 1120	1636	Host.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
872	schtasks.exe
900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
756	PO 059420.exe
1636	Host.exe
1636	Host.exe
1636	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	PO 059420.exe
Token: SeDebugPrivilege	1636	Host.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 872	756	PO 059420.exe	28
PID 756 wrote to memory of 872	756	PO 059420.exe	28
PID 756 wrote to memory of 872	756	PO 059420.exe	28
PID 756 wrote to memory of 872	756	PO 059420.exe	28
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 756 wrote to memory of 524	756	PO 059420.exe	30
PID 524 wrote to memory of 1636	524	PO 059420.exe	31
PID 524 wrote to memory of 1636	524	PO 059420.exe	31
PID 524 wrote to memory of 1636	524	PO 059420.exe	31
PID 524 wrote to memory of 1636	524	PO 059420.exe	31
PID 1636 wrote to memory of 900	1636	Host.exe	32
PID 1636 wrote to memory of 900	1636	Host.exe	32
PID 1636 wrote to memory of 900	1636	Host.exe	32
PID 1636 wrote to memory of 900	1636	Host.exe	32
PID 1636 wrote to memory of 532	1636	Host.exe	34
PID 1636 wrote to memory of 532	1636	Host.exe	34
PID 1636 wrote to memory of 532	1636	Host.exe	34
PID 1636 wrote to memory of 532	1636	Host.exe	34
PID 1636 wrote to memory of 1996	1636	Host.exe	36
PID 1636 wrote to memory of 1996	1636	Host.exe	36
PID 1636 wrote to memory of 1996	1636	Host.exe	36
PID 1636 wrote to memory of 1996	1636	Host.exe	36
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35
PID 1636 wrote to memory of 1120	1636	Host.exe	35

C:\Users\Admin\AppData\Local\Temp\PO 059420.exe
"C:\Users\Admin\AppData\Local\Temp\PO 059420.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgzBzcEDZDX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp77A1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:872
- C:\Users\Admin\AppData\Local\Temp\PO 059420.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgzBzcEDZDX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5FA.tmp"
      4⤵
      Creates scheduled task(s)
      PID:900
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:532
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1120
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5FA.tmp
Size 1KB
SHA256 9e847d6494f766218e9214b0d41c866af5c73b02c9562439cbf5abb7ed8a69be
MD5 9b2914a5074211535a3128a28b9f69cf
SHA1 a7174d0d6c9c00018e77dcbecdfd1f4b0690ae64
SHA512 3b2a15b931e55b963393d486aa622337ab353575a5d038d84acda04aae0655cafb86a800483b9ba09a64346f91c8a2e9ac16966b71b4ac6b3af96e95692c07c7
MD5 SHA1 SHA512

Submit Download

tmp77A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp77A1.tmp
Size 1KB
SHA256 9e847d6494f766218e9214b0d41c866af5c73b02c9562439cbf5abb7ed8a69be
MD5 9b2914a5074211535a3128a28b9f69cf
SHA1 a7174d0d6c9c00018e77dcbecdfd1f4b0690ae64
SHA512 3b2a15b931e55b963393d486aa622337ab353575a5d038d84acda04aae0655cafb86a800483b9ba09a64346f91c8a2e9ac16966b71b4ac6b3af96e95692c07c7
MD5 SHA1 SHA512

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path \Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/524-61-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/524-66-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/524-67-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/524-68-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/524-70-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/524-64-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/524-74-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/524-62-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/524-78-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/756-54-0x0000000000EF0000-0x0000000000F78000-memory.dmp

Download

memory/756-58-0x0000000000D50000-0x0000000000D7A000-memory.dmp

Download

memory/756-57-0x00000000057A0000-0x000000000581A000-memory.dmp

Download

memory/756-56-0x0000000000570000-0x0000000000590000-memory.dmp

Download

memory/756-55-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1120-100-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1120-101-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1636-80-0x00000000001D0000-0x0000000000258000-memory.dmp

Download