Analysis
-
max time kernel
20s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe
-
Size
551KB
-
MD5
6e6ec3d292326ed217a103377305c500
-
SHA1
11e2acb5f95ad758fa2c535c0766e81d01404043
-
SHA256
551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618
-
SHA512
5a324f72d19aaf3f56249ebd091837a238a2b143b31e4ed0ed6f547adf5b5e80a7bee19588137e86cb7cb403a9f079c5dc16a496a08d33cb262369fe860c0350
-
SSDEEP
12288:O7VVfiRuqPW/dgMqIHdjSFnnKCX0nU9Fb:O7VVfi40WlzdjSNnaUvb
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe RVHOST.exe" 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe -
Disables Task Manager via registry modification
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\RVHOST.exe" 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\t: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\e: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\f: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\k: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\u: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\v: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\z: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\h: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\i: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\l: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\n: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\o: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\w: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\y: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\a: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\b: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\g: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\j: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\p: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\q: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\r: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\s: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened (read-only) \??\x: 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\RVHOST.exe 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened for modification C:\Windows\SysWOW64\RVHOST.exe 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File created C:\Windows\SysWOW64\setting.ini 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File opened for modification C:\Windows\SysWOW64\setting.ini 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\RVHOST.exe 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe File created C:\Windows\RVHOST.exe 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1056 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe 27 PID 1324 wrote to memory of 1056 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe 27 PID 1324 wrote to memory of 1056 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe 27 PID 1324 wrote to memory of 1056 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe 27 PID 1056 wrote to memory of 2008 1056 cmd.exe 29 PID 1056 wrote to memory of 2008 1056 cmd.exe 29 PID 1056 wrote to memory of 2008 1056 cmd.exe 29 PID 1056 wrote to memory of 2008 1056 cmd.exe 29 PID 1324 wrote to memory of 796 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe 30 PID 1324 wrote to memory of 796 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe 30 PID 1324 wrote to memory of 796 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe 30 PID 1324 wrote to memory of 796 1324 551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe 30 PID 796 wrote to memory of 1988 796 cmd.exe 32 PID 796 wrote to memory of 1988 796 cmd.exe 32 PID 796 wrote to memory of 1988 796 cmd.exe 32 PID 796 wrote to memory of 1988 796 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe"C:\Users\Admin\AppData\Local\Temp\551f46eb7a57ce373b8cd0116875d3945183295e3d019a2c706721c25b815618.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe2⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe3⤵PID:1988
-
-