a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140

Analysis

max time kernel
149s
max time network
54s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
Size

392KB
MD5

90bbd08a32bbb6f857921c5fdce88400
SHA1

604a969183d18d2e5b285746576110acfedfa263
SHA256

a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140
SHA512

174712a4303d0dcf1d1b77e2e08ff978c23b11f82ac1f83e7550f3d12f666ed427c0b843c987ae22002eae34f09de9a5891eaac0a175e2fd7964783d7062e600
SSDEEP

12288:Ct8vVED3Bk0Mr9Vif7/F1hIIaYHuvAIS2r:Ct+gvMpVij/F1hV5HuvAIR

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
936	achsv.exe
1692	COM7.EXE
1996	COM7.EXE
568	achsv.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDF FoxitReader.exe	COM7.EXE

Loads dropped DLL 8 IoCs

pid	Process
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
936	achsv.exe
936	achsv.exe
1692	COM7.EXE
1692	COM7.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\COMLOADER = "\\\\.\\C:\\Program Files\\FoxitReader\\bin\\COM7.EXE"	reg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\FoxitReader\bin\COM7.EXE	COM7.EXE
File created	C:\Program Files\FoxitReader\FoxitReader.exe	COM7.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
756	reg.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
936	achsv.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1996	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
568	achsv.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
1692	COM7.EXE
1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
936	achsv.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 936	1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe	26
PID 1056 wrote to memory of 936	1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe	26
PID 1056 wrote to memory of 936	1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe	26
PID 1056 wrote to memory of 936	1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe	26
PID 1056 wrote to memory of 1692	1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe	27
PID 1056 wrote to memory of 1692	1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe	27
PID 1056 wrote to memory of 1692	1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe	27
PID 1056 wrote to memory of 1692	1056	a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe	27
PID 1692 wrote to memory of 756	1692	COM7.EXE	28
PID 1692 wrote to memory of 756	1692	COM7.EXE	28
PID 1692 wrote to memory of 756	1692	COM7.EXE	28
PID 1692 wrote to memory of 756	1692	COM7.EXE	28
PID 936 wrote to memory of 1996	936	achsv.exe	30
PID 936 wrote to memory of 1996	936	achsv.exe	30
PID 936 wrote to memory of 1996	936	achsv.exe	30
PID 936 wrote to memory of 1996	936	achsv.exe	30
PID 1692 wrote to memory of 568	1692	COM7.EXE	31
PID 1692 wrote to memory of 568	1692	COM7.EXE	31
PID 1692 wrote to memory of 568	1692	COM7.EXE	31
PID 1692 wrote to memory of 568	1692	COM7.EXE	31

C:\Users\Admin\AppData\Local\Temp\a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe
"C:\Users\Admin\AppData\Local\Temp\a6a996e6ed5a5760ad3120b2f9d2e3697386742ebd9a7e8ebf57f47b2ecb0140.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
    \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1996
- C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COMLOADER /d "\\.\C:\Program Files\FoxitReader\bin\COM7.EXE"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
    \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
92861e350432f085f0e3abeaf44d3040

SHA1
da509174207e72ba9969c5de7ebf3fe8f58156ec

SHA256
492fc8a93ad0e1ef9e293567534fd9784c31d456a24d9d166b8d72bc8615ec49

SHA512
a5671955d95c6bf2839167b0a36fb8dc6fcc69f6bff94c2b175452d5654d99d344b0617acbe9ce81a7e57a1e8af2792d8d119b4b2b6bafcb40a86890c4ea1617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
92861e350432f085f0e3abeaf44d3040

SHA1
da509174207e72ba9969c5de7ebf3fe8f58156ec

SHA256
492fc8a93ad0e1ef9e293567534fd9784c31d456a24d9d166b8d72bc8615ec49

SHA512
a5671955d95c6bf2839167b0a36fb8dc6fcc69f6bff94c2b175452d5654d99d344b0617acbe9ce81a7e57a1e8af2792d8d119b4b2b6bafcb40a86890c4ea1617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
92861e350432f085f0e3abeaf44d3040

SHA1
da509174207e72ba9969c5de7ebf3fe8f58156ec

SHA256
492fc8a93ad0e1ef9e293567534fd9784c31d456a24d9d166b8d72bc8615ec49

SHA512
a5671955d95c6bf2839167b0a36fb8dc6fcc69f6bff94c2b175452d5654d99d344b0617acbe9ce81a7e57a1e8af2792d8d119b4b2b6bafcb40a86890c4ea1617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
10e72aae6e10a21dc94b36cb651fbbe9

SHA1
cb753e4d64d9a5f757d778766aae957a331da1ce

SHA256
90f6a39d4c6f589c3a2e636a4dc91053488fb6fad7642c8a4970a7bf201d9041

SHA512
32e73d71030b06384478aa494dfbae17fffb2560d5fc5c424aab2766bfe26dfc059b6b78a4c663db5deed353a4cd9df766768ee92f259ef55a9ba1d371274130

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
10e72aae6e10a21dc94b36cb651fbbe9

SHA1
cb753e4d64d9a5f757d778766aae957a331da1ce

SHA256
90f6a39d4c6f589c3a2e636a4dc91053488fb6fad7642c8a4970a7bf201d9041

SHA512
32e73d71030b06384478aa494dfbae17fffb2560d5fc5c424aab2766bfe26dfc059b6b78a4c663db5deed353a4cd9df766768ee92f259ef55a9ba1d371274130

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
10e72aae6e10a21dc94b36cb651fbbe9

SHA1
cb753e4d64d9a5f757d778766aae957a331da1ce

SHA256
90f6a39d4c6f589c3a2e636a4dc91053488fb6fad7642c8a4970a7bf201d9041

SHA512
32e73d71030b06384478aa494dfbae17fffb2560d5fc5c424aab2766bfe26dfc059b6b78a4c663db5deed353a4cd9df766768ee92f259ef55a9ba1d371274130

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
92861e350432f085f0e3abeaf44d3040

SHA1
da509174207e72ba9969c5de7ebf3fe8f58156ec

SHA256
492fc8a93ad0e1ef9e293567534fd9784c31d456a24d9d166b8d72bc8615ec49

SHA512
a5671955d95c6bf2839167b0a36fb8dc6fcc69f6bff94c2b175452d5654d99d344b0617acbe9ce81a7e57a1e8af2792d8d119b4b2b6bafcb40a86890c4ea1617

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
92861e350432f085f0e3abeaf44d3040

SHA1
da509174207e72ba9969c5de7ebf3fe8f58156ec

SHA256
492fc8a93ad0e1ef9e293567534fd9784c31d456a24d9d166b8d72bc8615ec49

SHA512
a5671955d95c6bf2839167b0a36fb8dc6fcc69f6bff94c2b175452d5654d99d344b0617acbe9ce81a7e57a1e8af2792d8d119b4b2b6bafcb40a86890c4ea1617

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
92861e350432f085f0e3abeaf44d3040

SHA1
da509174207e72ba9969c5de7ebf3fe8f58156ec

SHA256
492fc8a93ad0e1ef9e293567534fd9784c31d456a24d9d166b8d72bc8615ec49

SHA512
a5671955d95c6bf2839167b0a36fb8dc6fcc69f6bff94c2b175452d5654d99d344b0617acbe9ce81a7e57a1e8af2792d8d119b4b2b6bafcb40a86890c4ea1617

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
92861e350432f085f0e3abeaf44d3040

SHA1
da509174207e72ba9969c5de7ebf3fe8f58156ec

SHA256
492fc8a93ad0e1ef9e293567534fd9784c31d456a24d9d166b8d72bc8615ec49

SHA512
a5671955d95c6bf2839167b0a36fb8dc6fcc69f6bff94c2b175452d5654d99d344b0617acbe9ce81a7e57a1e8af2792d8d119b4b2b6bafcb40a86890c4ea1617

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
10e72aae6e10a21dc94b36cb651fbbe9

SHA1
cb753e4d64d9a5f757d778766aae957a331da1ce

SHA256
90f6a39d4c6f589c3a2e636a4dc91053488fb6fad7642c8a4970a7bf201d9041

SHA512
32e73d71030b06384478aa494dfbae17fffb2560d5fc5c424aab2766bfe26dfc059b6b78a4c663db5deed353a4cd9df766768ee92f259ef55a9ba1d371274130

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
10e72aae6e10a21dc94b36cb651fbbe9

SHA1
cb753e4d64d9a5f757d778766aae957a331da1ce

SHA256
90f6a39d4c6f589c3a2e636a4dc91053488fb6fad7642c8a4970a7bf201d9041

SHA512
32e73d71030b06384478aa494dfbae17fffb2560d5fc5c424aab2766bfe26dfc059b6b78a4c663db5deed353a4cd9df766768ee92f259ef55a9ba1d371274130

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
10e72aae6e10a21dc94b36cb651fbbe9

SHA1
cb753e4d64d9a5f757d778766aae957a331da1ce

SHA256
90f6a39d4c6f589c3a2e636a4dc91053488fb6fad7642c8a4970a7bf201d9041

SHA512
32e73d71030b06384478aa494dfbae17fffb2560d5fc5c424aab2766bfe26dfc059b6b78a4c663db5deed353a4cd9df766768ee92f259ef55a9ba1d371274130

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
10e72aae6e10a21dc94b36cb651fbbe9

SHA1
cb753e4d64d9a5f757d778766aae957a331da1ce

SHA256
90f6a39d4c6f589c3a2e636a4dc91053488fb6fad7642c8a4970a7bf201d9041

SHA512
32e73d71030b06384478aa494dfbae17fffb2560d5fc5c424aab2766bfe26dfc059b6b78a4c663db5deed353a4cd9df766768ee92f259ef55a9ba1d371274130

Download Submit
memory/1056-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download