dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101

Analysis

max time kernel
33s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
Size

359KB
MD5

47baaf2fbc235eb9de77724feee480fb
SHA1

ab065af2571ab669515ab6b93379e14e7346f22d
SHA256

dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101
SHA512

b607db6e1f58eb2c4eaaf25b594ccb027cc4002194615ff0c239d4954a9ee7617c678ff19c773fb936b71e68a0ec797d205d6dc1369f41b88463c8f2ff6ea238
SSDEEP

6144:Q1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59kI5MI8D0lXuk:QjkArEN249AyE/rbaMct4bO2/VJpplXF

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1952	server.exe
632	server.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1976-59-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/1976-60-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1976-59-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral1/memory/1976-60-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1952 set thread context of 632	1952	server.exe	27

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\server.exe	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
File opened for modification	C:\Program Files (x86)\server.exe	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
632	server.exe
632	server.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1952	1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe	26
PID 1976 wrote to memory of 1952	1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe	26
PID 1976 wrote to memory of 1952	1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe	26
PID 1976 wrote to memory of 1952	1976	dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe	26
PID 1952 wrote to memory of 632	1952	server.exe	27
PID 1952 wrote to memory of 632	1952	server.exe	27
PID 1952 wrote to memory of 632	1952	server.exe	27
PID 1952 wrote to memory of 632	1952	server.exe	27
PID 1952 wrote to memory of 632	1952	server.exe	27
PID 1952 wrote to memory of 632	1952	server.exe	27
PID 1952 wrote to memory of 632	1952	server.exe	27
PID 1952 wrote to memory of 632	1952	server.exe	27
PID 632 wrote to memory of 1232	632	server.exe	17
PID 632 wrote to memory of 1232	632	server.exe	17
PID 632 wrote to memory of 1232	632	server.exe	17
PID 632 wrote to memory of 1232	632	server.exe	17

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe
  "C:\Users\Admin\AppData\Local\Temp\dfff4404103f050b6f4d89c76bad75fdd2e5e37fb9a0f1c5bb591a59e2b6c101.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Program Files (x86)\server.exe
    "C:\Program Files (x86)/server.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Program Files (x86)\server.exe
      "C:\Program Files (x86)\server.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\server.exe

Filesize
67KB

MD5
b9c6a38e3663541ae5a0b906f1d15efa

SHA1
1a5195b65a5a15b09bbe21c987a028704fc1e74e

SHA256
ee07feaeaaeab5f22cce42e83ad54e9ed0c0a09fc7100043b3966e91c946b4ce

SHA512
abfb14aa7547706778978b8af35c720d36a5253773c24bb76f88c2a20cc58ee4de331c1a66937bf7ea4c2cedf9313e5318dda9ed2472696b648d57c7ec920a6d

Download Submit
C:\Program Files (x86)\server.exe

Filesize
67KB

MD5
b9c6a38e3663541ae5a0b906f1d15efa

SHA1
1a5195b65a5a15b09bbe21c987a028704fc1e74e

SHA256
ee07feaeaaeab5f22cce42e83ad54e9ed0c0a09fc7100043b3966e91c946b4ce

SHA512
abfb14aa7547706778978b8af35c720d36a5253773c24bb76f88c2a20cc58ee4de331c1a66937bf7ea4c2cedf9313e5318dda9ed2472696b648d57c7ec920a6d

Download Submit
C:\Program Files (x86)\server.exe

Filesize
67KB

MD5
b9c6a38e3663541ae5a0b906f1d15efa

SHA1
1a5195b65a5a15b09bbe21c987a028704fc1e74e

SHA256
ee07feaeaaeab5f22cce42e83ad54e9ed0c0a09fc7100043b3966e91c946b4ce

SHA512
abfb14aa7547706778978b8af35c720d36a5253773c24bb76f88c2a20cc58ee4de331c1a66937bf7ea4c2cedf9313e5318dda9ed2472696b648d57c7ec920a6d

Download Submit
\Program Files (x86)\server.exe

Filesize
67KB

MD5
b9c6a38e3663541ae5a0b906f1d15efa

SHA1
1a5195b65a5a15b09bbe21c987a028704fc1e74e

SHA256
ee07feaeaaeab5f22cce42e83ad54e9ed0c0a09fc7100043b3966e91c946b4ce

SHA512
abfb14aa7547706778978b8af35c720d36a5253773c24bb76f88c2a20cc58ee4de331c1a66937bf7ea4c2cedf9313e5318dda9ed2472696b648d57c7ec920a6d

Download Submit
\Program Files (x86)\server.exe

Filesize
67KB

MD5
b9c6a38e3663541ae5a0b906f1d15efa

SHA1
1a5195b65a5a15b09bbe21c987a028704fc1e74e

SHA256
ee07feaeaaeab5f22cce42e83ad54e9ed0c0a09fc7100043b3966e91c946b4ce

SHA512
abfb14aa7547706778978b8af35c720d36a5253773c24bb76f88c2a20cc58ee4de331c1a66937bf7ea4c2cedf9313e5318dda9ed2472696b648d57c7ec920a6d

Download Submit
memory/632-7049-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/632-7048-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/632-7043-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1952-88-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-93-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-71-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-72-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-73-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-74-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-75-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-76-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-77-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-78-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-79-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-80-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-81-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-82-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-84-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-86-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-89-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-69-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-87-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-85-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-91-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-92-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-90-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-70-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-94-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-95-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-96-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-97-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-98-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-106-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-109-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-110-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-111-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-115-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-114-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-113-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-117-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-65-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-64-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-63-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1952-62-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1976-59-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1976-60-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download