Analysis
-
max time kernel
65s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe
-
Size
570KB
-
MD5
68401380b7b06931f3aa01fe52330178
-
SHA1
0b3f19aed873631a5f407feeafcd264288f4b9c0
-
SHA256
80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf
-
SHA512
1932ee1bbb3029cbbe33cce356b9db9f13ccbcdd6c7bf229dc84923caf8da5879800c1ca704b6a51baf06941a64a47386888404dd056f839ae37dddf86718a9b
-
SSDEEP
6144:9j67wjsJHnPyNmeAJg57xoP3yf1UHmUwPSWpg2f82VD:l67jqNmev57xoPifrPS2g21D
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe svchosl.exe" 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\svchosl.exe" 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\n: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\p: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\r: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\a: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\b: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\h: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\i: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\t: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\u: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\w: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\x: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\k: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\l: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\f: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\g: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\j: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\v: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\y: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\z: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\e: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\o: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\q: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened (read-only) \??\s: 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\autorun.ini 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File created C:\Windows\SysWOW64\svchosl.exe 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened for modification C:\Windows\SysWOW64\svchosl.exe 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\browserconfig.properties 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\svchosl.exe 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File opened for modification C:\Windows\browserconfig.properties 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe File created C:\Windows\svchosl.exe 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4884 wrote to memory of 4808 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 81 PID 4884 wrote to memory of 4808 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 81 PID 4884 wrote to memory of 4808 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 81 PID 4808 wrote to memory of 2676 4808 cmd.exe 83 PID 4808 wrote to memory of 2676 4808 cmd.exe 83 PID 4808 wrote to memory of 2676 4808 cmd.exe 83 PID 4884 wrote to memory of 1080 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 84 PID 4884 wrote to memory of 1080 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 84 PID 4884 wrote to memory of 1080 4884 80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe 84 PID 1080 wrote to memory of 2256 1080 cmd.exe 86 PID 1080 wrote to memory of 2256 1080 cmd.exe 86 PID 1080 wrote to memory of 2256 1080 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe"C:\Users\Admin\AppData\Local\Temp\80e3f7af04f84d22e4cff09a8cae84934f55abcf4fff3861b43c9f1503421dcf.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:2676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchosl.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchosl.exe3⤵PID:2256
-
-