Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 00:00
Behavioral task
behavioral1
Sample
1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe
-
Size
344KB
-
MD5
0973f8743e5afe579561755792753170
-
SHA1
3eff66456f654f39ad859c36d6d861026b1de30c
-
SHA256
1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886
-
SHA512
78b0f40c5d0285fe9f14227d895d9522d0f27497b74e1dfbbb79da92c44660adb0924ff7f03e24433befd5afe7dc3e4804936f4cb94c2b0c3ecdf2d09f7de933
-
SSDEEP
6144:bZxHBj+Y4ZuikcOIxpOrpuxIZzPIGXacPywr27lVkUM73PcGKDZ7tqX4IfDJwEIh:dDAZucDO79IGX2wwLkUa3PcGKRtqfJwP
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe -
resource yara_rule behavioral1/memory/1832-55-0x0000000000E10000-0x0000000001020000-memory.dmp upx behavioral1/files/0x0008000000013402-56.dat upx behavioral1/memory/1832-59-0x0000000000E10000-0x0000000001020000-memory.dmp upx behavioral1/files/0x0008000000013402-58.dat upx behavioral1/memory/544-60-0x0000000000390000-0x00000000005D1000-memory.dmp upx behavioral1/files/0x0008000000013402-64.dat upx behavioral1/memory/544-65-0x0000000000390000-0x00000000005D1000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{A4FC6719-AFD5-4F8E-8138-B35FA78CD671} 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{A4FC6719-AFD5-4F8E-8138-B35FA78CD671} 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{A4FC6719-AFD5-4F8E-8138-B35FA78CD671}\ = "6267" 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74E6B08-282D-F507-C40D-078908F79C8D}\{D24D19C4-6656-0C5A-A7B1-F9C2486DD70B} = 0900000032034e0d0b500823550107221646026206 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74E6B08-282D-F507-C40D-078908F79C8D}\{D24D19C4-6656-0C5A-A7B1-F9C2486DD70B} = 0900000032034e0d6384c37a3dd5cc7b7e92c93b6e 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{A4FC6719-AFD5-4F8E-8138-B35FA78CD671}\ = "14935" 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74E6B08-282D-F507-C40D-078908F79C8D} 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe Token: SeDebugPrivilege 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1832 wrote to memory of 544 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 29 PID 1832 wrote to memory of 544 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 29 PID 1832 wrote to memory of 544 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 29 PID 1832 wrote to memory of 544 1832 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 29 PID 544 wrote to memory of 1256 544 1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe 15
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe"C:\Users\Admin\AppData\Local\Temp\1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe"2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe"C:\Users\Admin\AppData\Local\Temp\1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe
Filesize403KB
MD57e1618fb4a10638d36985934c7fb0fb1
SHA14005c9c21581f83c6ec857253e9dc9aedd0a2acf
SHA2566b87f0670c3ca00422a0ffa1821e5c2c271976e73a60a7651c4110e097e6f278
SHA512dd102801707b475625e9dc82ea4700bc4ca6a1dbbba5e240c2d3f39e13a4922f300e74327c6fa55fba01a00c5353bacf715548693ca3a3ed193ac8ac9219ff6a
-
C:\Users\Admin\AppData\Local\Temp\1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe
Filesize403KB
MD57e1618fb4a10638d36985934c7fb0fb1
SHA14005c9c21581f83c6ec857253e9dc9aedd0a2acf
SHA2566b87f0670c3ca00422a0ffa1821e5c2c271976e73a60a7651c4110e097e6f278
SHA512dd102801707b475625e9dc82ea4700bc4ca6a1dbbba5e240c2d3f39e13a4922f300e74327c6fa55fba01a00c5353bacf715548693ca3a3ed193ac8ac9219ff6a
-
C:\Users\Admin\AppData\Local\Temp\1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f6988620221004.nbl
Filesize1KB
MD5b51ebecf7d3358fe2f0af5d518955120
SHA17ef8de73b1f1a83276bf6bcef1040f248c390373
SHA256a8ebd20972b480ad9adf8234a3026bf4c04bf9be757a46ba1865a01fdff008aa
SHA51269ef050d75615a4ed04a8259c3454cec8be420694b9bd74033324653a4c8de9fb50cc25adb1d89aa828d3e06dd2df846bfd18bd23120856c06d8872b95e904d4
-
\Users\Admin\AppData\Local\Temp\1ff83503555a0ed5bb6936cf142848ce8b449d81c063f5149f2db56380f69886.exe
Filesize403KB
MD57e1618fb4a10638d36985934c7fb0fb1
SHA14005c9c21581f83c6ec857253e9dc9aedd0a2acf
SHA2566b87f0670c3ca00422a0ffa1821e5c2c271976e73a60a7651c4110e097e6f278
SHA512dd102801707b475625e9dc82ea4700bc4ca6a1dbbba5e240c2d3f39e13a4922f300e74327c6fa55fba01a00c5353bacf715548693ca3a3ed193ac8ac9219ff6a