fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
Size

24KB
MD5

284dccd7574ce63fdbbb5d8b3204bb6b
SHA1

cb7fefae68a90edc9051a7392ffef185fa304932
SHA256

fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370
SHA512

16ce6fdd285805b7c011dfcc4b119b4fbf000b6f80c22cb112558499105c19b9f95c04744f72255ada0a583263bb0e341b9224e152c019e2e5e95999904e6955
SSDEEP

384:olBy/jZ+wOu1hhoz5nAoQKnnd1adMTqPobFlYM2hakiKf6siRbXLaQDHOH0pU2hs:oa/tjKzauTwobFu/iKel6z

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

988 cmd.exe

pid	process
988	cmd.exe

Drops file in System32 directory 5 IoCs

Processes:

fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\1232723.tmp	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
File created	C:\Windows\SysWOW64\sxload.tmp	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
File created	C:\Windows\System32\12325DA.tmp	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
File opened for modification	C:\Windows\SysWOW64\12325DA.tmp	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
File created	C:\Windows\System32\1232723.tmp	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe

Drops file in Program Files directory 1 IoCs

Processes:

fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe

description ioc process

File created C:\Program Files (x86)\Common Files\sxyy.tmp fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1740 taskkill.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\sxyy.tmp	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe

pid	process
1740	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
Token: SeDebugPrivilege	1740	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe

pid	process
1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe

description	pid	process	target process
PID 1196 wrote to memory of 1740	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe	taskkill.exe
PID 1196 wrote to memory of 1740	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe	taskkill.exe
PID 1196 wrote to memory of 1740	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe	taskkill.exe
PID 1196 wrote to memory of 1740	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe	taskkill.exe
PID 1196 wrote to memory of 988	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe	cmd.exe
PID 1196 wrote to memory of 988	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe	cmd.exe
PID 1196 wrote to memory of 988	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe	cmd.exe
PID 1196 wrote to memory of 988	1196	fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe
"C:\Users\Admin\AppData\Local\Temp\fd0c65078b927aad612efd58dfbaa09017677349997f66abf1d39e67e5ae3370.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "yy.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\SysWOW64\cmd.exe
cmd /c 1.bat
2⤵
- Deletes itself
PID:988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat
Filesize
251B

MD5
f5392f065d83c6215708f4b59e16ef69

SHA1
e4e451ee35970240dbef1bc14418f63e31336aa0

SHA256
26e9d8f7227b9c7b5cfe88992be156ab2c27cc207b54cbfa28d3f4350890c57b

SHA512
d900d4a6dc062d434986b609b42b41305d123635666f3698aab259c6e820e481c9d8cf562bab66c90e3365ffa0afb8421bf5ae232ef6c24c0d799bef91bae43b

Download Submit
memory/988-57-0x0000000000000000-mapping.dmp

Download
memory/1196-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1196-55-0x0000000075081000-0x0000000075083000-memory.dmp

Filesize
8KB

Download
memory/1740-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads