Analysis
-
max time kernel
10s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-10-2022 21:39
Behavioral task
behavioral1
Sample
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe
Resource
win7-20220812-en
General
-
Target
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe
-
Size
33KB
-
MD5
4c9cef23f592a028cee6534b90801b6b
-
SHA1
509b191b8f762bdc247096c120d09e79fae96e83
-
SHA256
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672
-
SHA512
d548b5d9aa95cdb3a1e7f732950e80e81f23b0bc79ee7103d0e46e903d860dedf8d6c660c3d8ff6b5af3f0e51a19235c2f9fbff34017c8a42dfba28f206697f4
-
SSDEEP
384:I1rO/m6JuAa26QtdZmsmfU/eAri+DngqDUbhCD2SlAI9LiNvLp+Cw:xJu/MZmFArKqPD2S64LIlT
Malware Config
Signatures
-
Processes:
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
k4.exek4.exek4.exek4.exepid process 956 k4.exe 580 k4.exe 956 k4.exe 580 k4.exe -
Processes:
resource yara_rule behavioral1/memory/1980-55-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1980-55-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exepid process 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe -
Processes:
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1164 taskkill.exe 1164 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
k4.exek4.exedescription pid process Token: SeLoadDriverPrivilege 580 k4.exe Token: SeLoadDriverPrivilege 580 k4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exepid process 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.execmd.exe1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.execmd.exedescription pid process target process PID 1980 wrote to memory of 956 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 956 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 956 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 956 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 580 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 580 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 580 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 580 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 916 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe cmd.exe PID 1980 wrote to memory of 916 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe cmd.exe PID 1980 wrote to memory of 916 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe cmd.exe PID 1980 wrote to memory of 916 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe cmd.exe PID 916 wrote to memory of 1164 916 cmd.exe taskkill.exe PID 916 wrote to memory of 1164 916 cmd.exe taskkill.exe PID 916 wrote to memory of 1164 916 cmd.exe taskkill.exe PID 916 wrote to memory of 1164 916 cmd.exe taskkill.exe PID 1980 wrote to memory of 956 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 956 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 956 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 956 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 580 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 580 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 580 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 580 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe k4.exe PID 1980 wrote to memory of 916 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe cmd.exe PID 1980 wrote to memory of 916 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe cmd.exe PID 1980 wrote to memory of 916 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe cmd.exe PID 1980 wrote to memory of 916 1980 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe cmd.exe PID 916 wrote to memory of 1164 916 cmd.exe taskkill.exe PID 916 wrote to memory of 1164 916 cmd.exe taskkill.exe PID 916 wrote to memory of 1164 916 cmd.exe taskkill.exe PID 916 wrote to memory of 1164 916 cmd.exe taskkill.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe"C:\Users\Admin\AppData\Local\Temp\1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im k4.exe3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe"C:\Users\Admin\AppData\Local\Temp\1c7f436f831d5f4b12ed0e74e60d1535ec802d9812a6121a3d56ec0897f9f672.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im k4.exe3⤵
- Kills process with taskkill
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
memory/580-61-0x0000000000000000-mapping.dmp
-
memory/580-61-0x0000000000000000-mapping.dmp
-
memory/916-64-0x0000000000000000-mapping.dmp
-
memory/916-64-0x0000000000000000-mapping.dmp
-
memory/956-59-0x000007FEFB831000-0x000007FEFB833000-memory.dmpFilesize
8KB
-
memory/956-57-0x0000000000000000-mapping.dmp
-
memory/956-59-0x000007FEFB831000-0x000007FEFB833000-memory.dmpFilesize
8KB
-
memory/956-57-0x0000000000000000-mapping.dmp
-
memory/1164-65-0x0000000000000000-mapping.dmp
-
memory/1164-65-0x0000000000000000-mapping.dmp
-
memory/1980-55-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1980-54-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB
-
memory/1980-54-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB
-
memory/1980-55-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB