Analysis
-
max time kernel
179s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2022, 15:13
Static task
static1
Behavioral task
behavioral1
Sample
d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe
-
Size
341KB
-
MD5
4903c7994bf82f20cf15775f562091bc
-
SHA1
58d49be4c4bc0e49a7b3a82a128e21bb0d6a102a
-
SHA256
d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5
-
SHA512
d52697f01a1bf3ef799a6177ca0d05546600b06fb60fbfb0f36524c26e75538c09eb57251aa89cc2a3b132945a79c76bfececf7f65c41634eccf109c10df8069
-
SSDEEP
3072:SYbDXo+kkXT2d3aJg2GjxOvFRr42kmDb6pI32pIyIMLYdkWGqzjTA1AVX+eo9PZG:Z/0qTn9J4LmDuvayK1GqziulGxG7Hz
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sychost.exe" d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sychost.exe d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Windows\SysWOW64\sychost.exe d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe -
Drops file in Program Files directory 58 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\hy.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\7zG.exe d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\7z.exe d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\History.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4456 d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe 4456 d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe 4456 d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe 4456 d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe 4456 d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe 4456 d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe 4456 d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe 4456 d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe"C:\Users\Admin\AppData\Local\Temp\d573214091d21c55a486630cd868c4c47c1f6fbc75da34287c4e22347cd771e5.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4456