Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
10-10-2022 21:36
Static task
static1
General
-
Target
bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe
-
Size
871KB
-
MD5
8dcec334c74becd217f0f61c53a45a54
-
SHA1
02a178c1bdd24a780c491c2efe1dcf6bb6be13f7
-
SHA256
bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b
-
SHA512
bf8b6f0043aa222be36c4c6816a95a62a8cc17bbee4454d110d590e2bde7e3ca60504cae01196cf6a2a31f92dd874517fde082dfa505a394b2bf2bbda3a76695
-
SSDEEP
12288:q39riVwf3iJ+HN3TF4W7Wba0WGU68RnAgqgNYEgeGEKDBjs2sd0psmCA+Pdm7Y7a:qNriy/fTFOzgCGTjUDn/MI9d
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
MoUSO.exeMoUSO.exepid process 4720 MoUSO.exe 2260 MoUSO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exedescription pid process target process PID 2896 set thread context of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exeMoUSO.exepid process 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe 4720 MoUSO.exe 4720 MoUSO.exe 4720 MoUSO.exe 4720 MoUSO.exe 4720 MoUSO.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exeMoUSO.exedescription pid process Token: SeDebugPrivilege 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe Token: SeDebugPrivilege 4720 MoUSO.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exebf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exeMoUSO.exedescription pid process target process PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 3808 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 2604 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 2896 wrote to memory of 4512 2896 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe PID 4512 wrote to memory of 4640 4512 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe schtasks.exe PID 4512 wrote to memory of 4640 4512 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe schtasks.exe PID 4512 wrote to memory of 4640 4512 bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe schtasks.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 2260 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe PID 4720 wrote to memory of 3212 4720 MoUSO.exe MoUSO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"2⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"2⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"3⤵
- Creates scheduled task(s)
PID:4640
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeC:\Users\Admin\AppData\Local\cache\MoUSO.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\cache\MoUSO.exe"C:\Users\Admin\AppData\Local\cache\MoUSO.exe"2⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\cache\MoUSO.exe"C:\Users\Admin\AppData\Local\cache\MoUSO.exe"2⤵PID:3212
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
871KB
MD58dcec334c74becd217f0f61c53a45a54
SHA102a178c1bdd24a780c491c2efe1dcf6bb6be13f7
SHA256bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b
SHA512bf8b6f0043aa222be36c4c6816a95a62a8cc17bbee4454d110d590e2bde7e3ca60504cae01196cf6a2a31f92dd874517fde082dfa505a394b2bf2bbda3a76695
-
Filesize
871KB
MD58dcec334c74becd217f0f61c53a45a54
SHA102a178c1bdd24a780c491c2efe1dcf6bb6be13f7
SHA256bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b
SHA512bf8b6f0043aa222be36c4c6816a95a62a8cc17bbee4454d110d590e2bde7e3ca60504cae01196cf6a2a31f92dd874517fde082dfa505a394b2bf2bbda3a76695
-
Filesize
871KB
MD58dcec334c74becd217f0f61c53a45a54
SHA102a178c1bdd24a780c491c2efe1dcf6bb6be13f7
SHA256bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b
SHA512bf8b6f0043aa222be36c4c6816a95a62a8cc17bbee4454d110d590e2bde7e3ca60504cae01196cf6a2a31f92dd874517fde082dfa505a394b2bf2bbda3a76695