efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f

Analysis

max time kernel
47s
max time network
74s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Size

153KB
MD5

6910a1247c6f7838dfcf6e6679f73921
SHA1

db5214cba33a029c9f8ed81d51aea0012c1e46a8
SHA256

efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f
SHA512

597ca1afb357b2c8aaee52e354dc9933c8f95bc050b07002b2ca47768ddda233cb4f0aa65b9af531fd154780de7c5f127893c75c1eb5d9fe3a99762296e48508
SSDEEP

3072:aOLwcn/j/z/xWikNEPhFsV5D6SSKgU5B1+uPf+LPBmirQv/:aOLwcn/rzXbsVl6SSKgUvPeB5

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1552-55-0x0000000001000000-0x000000000104F000-memory.dmp	upx
behavioral1/memory/1552-57-0x0000000001000000-0x000000000104F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1552	efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe

C:\Users\Admin\AppData\Local\Temp\efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe
"C:\Users\Admin\AppData\Local\Temp\efb3de3f48d434481f20d380448c4c592b85a27a08ed5676ceb5c55efce51a6f.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1552-55-0x0000000001000000-0x000000000104F000-memory.dmp

Filesize
316KB

Download
memory/1552-56-0x0000000074811000-0x0000000074813000-memory.dmp

Filesize
8KB

Download
memory/1552-57-0x0000000001000000-0x000000000104F000-memory.dmp

Filesize
316KB

Download