Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 03:45
Static task
static1
Behavioral task
behavioral1
Sample
fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe
Resource
win10v2004-20220901-en
General
-
Target
fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe
-
Size
201KB
-
MD5
58a112ce5cc23abef38eaf0ff9c6a7a6
-
SHA1
55112c283a850c39268c3b3fe891f50fefddd33b
-
SHA256
fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
-
SHA512
46352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6
-
SSDEEP
6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFq:HqEjk7l7Fq
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 892 security.exe 1636 security.exe -
resource yara_rule behavioral1/memory/1928-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1928-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1928-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1928-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1928-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1928-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1928-108-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1636-110-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1636-112-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 5 IoCs
pid Process 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\security.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1880 set thread context of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 892 set thread context of 1636 892 security.exe 32 PID 892 set thread context of 1868 892 security.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe Token: SeDebugPrivilege 1636 security.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 892 security.exe 1636 security.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1880 wrote to memory of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 1880 wrote to memory of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 1880 wrote to memory of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 1880 wrote to memory of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 1880 wrote to memory of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 1880 wrote to memory of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 1880 wrote to memory of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 1880 wrote to memory of 1928 1880 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 27 PID 1928 wrote to memory of 1940 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 28 PID 1928 wrote to memory of 1940 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 28 PID 1928 wrote to memory of 1940 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 28 PID 1928 wrote to memory of 1940 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 28 PID 1940 wrote to memory of 1696 1940 cmd.exe 30 PID 1940 wrote to memory of 1696 1940 cmd.exe 30 PID 1940 wrote to memory of 1696 1940 cmd.exe 30 PID 1940 wrote to memory of 1696 1940 cmd.exe 30 PID 1928 wrote to memory of 892 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 31 PID 1928 wrote to memory of 892 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 31 PID 1928 wrote to memory of 892 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 31 PID 1928 wrote to memory of 892 1928 fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe 31 PID 892 wrote to memory of 1636 892 security.exe 32 PID 892 wrote to memory of 1636 892 security.exe 32 PID 892 wrote to memory of 1636 892 security.exe 32 PID 892 wrote to memory of 1636 892 security.exe 32 PID 892 wrote to memory of 1636 892 security.exe 32 PID 892 wrote to memory of 1636 892 security.exe 32 PID 892 wrote to memory of 1636 892 security.exe 32 PID 892 wrote to memory of 1636 892 security.exe 32 PID 892 wrote to memory of 1868 892 security.exe 33 PID 892 wrote to memory of 1868 892 security.exe 33 PID 892 wrote to memory of 1868 892 security.exe 33 PID 892 wrote to memory of 1868 892 security.exe 33 PID 892 wrote to memory of 1868 892 security.exe 33 PID 892 wrote to memory of 1868 892 security.exe 33 PID 892 wrote to memory of 1868 892 security.exe 33 PID 892 wrote to memory of 1868 892 security.exe 33 PID 892 wrote to memory of 1868 892 security.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe"C:\Users\Admin\AppData\Local\Temp\fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe"C:\Users\Admin\AppData\Local\Temp\fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\IHUBK.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f4⤵
- Adds Run key to start application
PID:1696
-
-
-
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵PID:1868
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD56f473a1ba53e043362047f72e20b34f4
SHA1e8f121a589e1207ed950453376ee1d21b1223835
SHA2565fbce2c77a90ba9edbcf60be3851ab81633b7c10b1babb624d475c7be589de4b
SHA512b4976d40bc708ae6cddf367a5382cd532e4cf235b848cdaa4e4d317e06d9126e50745a7772591bc21dc7380689f4399e57501b0aa73cd231bce32e22d53b0818
-
Filesize
201KB
MD558a112ce5cc23abef38eaf0ff9c6a7a6
SHA155112c283a850c39268c3b3fe891f50fefddd33b
SHA256fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
SHA51246352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6
-
Filesize
201KB
MD558a112ce5cc23abef38eaf0ff9c6a7a6
SHA155112c283a850c39268c3b3fe891f50fefddd33b
SHA256fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
SHA51246352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6
-
Filesize
201KB
MD558a112ce5cc23abef38eaf0ff9c6a7a6
SHA155112c283a850c39268c3b3fe891f50fefddd33b
SHA256fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
SHA51246352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6
-
Filesize
201KB
MD558a112ce5cc23abef38eaf0ff9c6a7a6
SHA155112c283a850c39268c3b3fe891f50fefddd33b
SHA256fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
SHA51246352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6
-
Filesize
201KB
MD558a112ce5cc23abef38eaf0ff9c6a7a6
SHA155112c283a850c39268c3b3fe891f50fefddd33b
SHA256fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
SHA51246352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6
-
Filesize
201KB
MD558a112ce5cc23abef38eaf0ff9c6a7a6
SHA155112c283a850c39268c3b3fe891f50fefddd33b
SHA256fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
SHA51246352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6
-
Filesize
201KB
MD558a112ce5cc23abef38eaf0ff9c6a7a6
SHA155112c283a850c39268c3b3fe891f50fefddd33b
SHA256fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
SHA51246352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6
-
Filesize
201KB
MD558a112ce5cc23abef38eaf0ff9c6a7a6
SHA155112c283a850c39268c3b3fe891f50fefddd33b
SHA256fc7434365089fdc62841327964d7543d517de3cdd9aad6deae2ca3b77fadc18d
SHA51246352d4a34477fe3fae49e0633b10051e9ec6d8407fe88e8d7564765e305689caf6d7a08f1e1bb20689422432f8b2a78b058cd731e4a4fb01818549bbade3bc6