Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
07/10/2022, 11:51
Behavioral task
behavioral1
Sample
1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe
- Size 1.5MB
- Sample221007-nz5z5scch6
- SHA256 1f66aa28cb5494391791dcf5f2c3ff15880862b5c43f257cbf9db889ae54aa1d
- MD5 8564d4583bbcc517c1615ecd6b1474b9
- SHA1 4b17aff2dff2782bf5f0b9bd5c886ffe5d3bcb7d
- SHA512 63f7e561bc4c71d65b0f66307180d39d49be4cfaca6dd5712fe95bb6a28266ae7c7e9e4e40821a5a3fa6302ebbbdc334a87b0d919183322b2c11d6a02a6c2ce2
- SSDEEP 24576:VthEVaPqLEkb9OvQ2pa7dKLvfBpi8thEVaPqLEkb9OvQ2pa7dKLvfBpiq:9EVUcavppa2BpiQEVUcavppa2Bpiq
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/536-132-0x0000000000400000-0x00000000004B6000-memory.dmp upx behavioral2/memory/536-135-0x0000000000400000-0x00000000004B6000-memory.dmp upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QYVRLM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\svchost.exe\"" 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/536-135-0x0000000000400000-0x00000000004B6000-memory.dmp autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 536 wrote to memory of 1292 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 82 PID 536 wrote to memory of 1292 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 82 PID 536 wrote to memory of 1292 536 1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe"C:\Users\Admin\AppData\Local\Temp\1F66AA28CB5494391791DCF5F2C3FF15880862B5C43F2.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\QYVRLM.vbs2⤵PID:1292
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\QYVRLM.vbs
- Size 910B
- SHA256 96e430409b867c330e76d4bc8080ba6c45989a628ac630b40bcd1a02e3b17d5e
- MD5 d483c5146e457eec3448a05295e22d35
- SHA1 b9ce974f3a258d220cd91f6c3c28ace6ce07b254
- SHA512 f2d9ebbf47a8ce5431aa66bc36d5dfbac55aa07e7fd5bf8dfde9139259dc543cd3e9b6c703b8ee0849eda7cf83d30af3063db914ce8e2bbb5dd5ce7fedecbd02
- MD5 SHA1 SHA512