Analysis
-
max time kernel
14s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 14:41
Static task
static1
Behavioral task
behavioral1
Sample
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe
Resource
win7-20220901-en
General
-
Target
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe
-
Size
32KB
-
MD5
b1a76512bd2449210a38aad628f5e1a3
-
SHA1
e2d5c4629742a37579eba17c722fd8177ea4a410
-
SHA256
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399
-
SHA512
24f6d10f7110e6b4855e6410384bdca6b37fe47b98c5a4001faccb7b8817dd961b06dc4eac1ead4989782413aff942f1d4adb2b5f286a310cd9bfe355a5eb46b
-
SSDEEP
192:60hg42Nzd2GQ/0jqEtJ2KLNGEt2hoynrLEgH9e2tnwRmd8MFA93M3pkR:60CvNwRtONGThlNde2tnwwd5ASc
Malware Config
Signatures
-
Processes:
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
k4.exek4.exek4.exek4.exepid process 1868 k4.exe 1524 k4.exe 1868 k4.exe 1524 k4.exe -
Loads dropped DLL 4 IoCs
Processes:
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exepid process 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe -
Processes:
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
k4.exek4.exedescription pid process Token: SeLoadDriverPrivilege 1524 k4.exe Token: SeLoadDriverPrivilege 1524 k4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exepid process 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exedescription pid process target process PID 1304 wrote to memory of 1868 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1868 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1868 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1868 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1524 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1524 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1524 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1524 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1916 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe cmd.exe PID 1304 wrote to memory of 1916 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe cmd.exe PID 1304 wrote to memory of 1916 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe cmd.exe PID 1304 wrote to memory of 1916 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe cmd.exe PID 1304 wrote to memory of 1868 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1868 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1868 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1868 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1524 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1524 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1524 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1524 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe k4.exe PID 1304 wrote to memory of 1916 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe cmd.exe PID 1304 wrote to memory of 1916 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe cmd.exe PID 1304 wrote to memory of 1916 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe cmd.exe PID 1304 wrote to memory of 1916 1304 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe cmd.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe"C:\Users\Admin\AppData\Local\Temp\31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe"C:\Users\Admin\AppData\Local\Temp\31187424e25004f7580b8defbe516ab09a6e5a4eb9e39ab1721279c5ecce8399.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\RDSv1.dllFilesize
40KB
MD52c17ae07feaf970be073135b9dc5318e
SHA1f425aee18136879afeb4931aa9eed777d595f2a6
SHA2567649bb85be19e09b67a581b0a988393328984f00f4bb3fb60a4dacfb0b773cf5
SHA5129f4dafb5f8e650b01255b1df25c80af76775736634dc846920ddf3d3165ece81d70d2860c9c73e1e146592bf5ded61ed36b3980283e23e5d705cfd4ae576cb6b
-
\Users\Public\Documents\RDSv1.dllFilesize
40KB
MD52c17ae07feaf970be073135b9dc5318e
SHA1f425aee18136879afeb4931aa9eed777d595f2a6
SHA2567649bb85be19e09b67a581b0a988393328984f00f4bb3fb60a4dacfb0b773cf5
SHA5129f4dafb5f8e650b01255b1df25c80af76775736634dc846920ddf3d3165ece81d70d2860c9c73e1e146592bf5ded61ed36b3980283e23e5d705cfd4ae576cb6b
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
memory/1304-54-0x00000000762E1000-0x00000000762E3000-memory.dmpFilesize
8KB
-
memory/1304-54-0x00000000762E1000-0x00000000762E3000-memory.dmpFilesize
8KB
-
memory/1524-61-0x0000000000000000-mapping.dmp
-
memory/1524-61-0x0000000000000000-mapping.dmp
-
memory/1868-59-0x000007FEFC211000-0x000007FEFC213000-memory.dmpFilesize
8KB
-
memory/1868-59-0x000007FEFC211000-0x000007FEFC213000-memory.dmpFilesize
8KB
-
memory/1868-57-0x0000000000000000-mapping.dmp
-
memory/1868-57-0x0000000000000000-mapping.dmp
-
memory/1916-64-0x0000000000000000-mapping.dmp
-
memory/1916-64-0x0000000000000000-mapping.dmp