544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352

Analysis

max time kernel
183s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe
Size

336KB
MD5

41bdbf477b31e57c8feee1bd8479cdb0
SHA1

e9e5b91971bdbbe68c6238ac0eaa529440cd944e
SHA256

544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352
SHA512

e2cd23e2a4b691513a05d827b3d7e88d1142ac4ec04403835d9715f25e61278dc61b04e46a79a0cdec6395fe4416bb961ddb81b7fe18722a0308b453d658f51b
SSDEEP

6144:XqwXsTcNUXc8vtBgANFGBg6HOMFPZfQiQyWCGR8iyfUInjxxaf1Uri4:Xqwcoavt2AfORFGCzVciS+r

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2024	RunMgr.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\RunMgr.EXE	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1572	2024	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2024	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	27
PID 1916 wrote to memory of 2024	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	27
PID 1916 wrote to memory of 2024	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	27
PID 1916 wrote to memory of 2024	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	27
PID 1916 wrote to memory of 1504	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	29
PID 1916 wrote to memory of 1504	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	29
PID 1916 wrote to memory of 1504	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	29
PID 1916 wrote to memory of 1504	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	29
PID 2024 wrote to memory of 1572	2024	RunMgr.EXE	28
PID 2024 wrote to memory of 1572	2024	RunMgr.EXE	28
PID 2024 wrote to memory of 1572	2024	RunMgr.EXE	28
PID 2024 wrote to memory of 1572	2024	RunMgr.EXE	28
PID 1916 wrote to memory of 1388	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	31
PID 1916 wrote to memory of 1388	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	31
PID 1916 wrote to memory of 1388	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	31
PID 1916 wrote to memory of 1388	1916	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	31

C:\Users\Admin\AppData\Local\Temp\544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe
"C:\Users\Admin\AppData\Local\Temp\544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\RunMgr.EXE
  "C:\Windows\RunMgr.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 36
    3⤵
    - Program crash
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del %SystemRoot%\Debug.exe
  2⤵
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\544D18~1.EXE > nul
  2⤵
  PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\RunMgr.EXE

Filesize
268KB

MD5
c17e648345690c4648a70adb87208388

SHA1
a778992b560699f307e2af982a37be3a0a80005b

SHA256
947b00ed4929668d80c203e898f68e9c19c153577831afc2d43fa1db5548a148

SHA512
b18d835462b8309b8e418ff7f7e4c059a6e239fdd56c193542be6ceab5dcdb52196b9ca97d07be409ffa92ddd4073309466741222f7911a1f39094d90be48737

Download Submit
memory/1916-54-0x0000000000400000-0x000000000045564E-memory.dmp

Filesize
341KB

Download
memory/1916-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1916-61-0x0000000002620000-0x0000000002726000-memory.dmp

Filesize
1.0MB

Download
memory/1916-62-0x0000000002620000-0x0000000002726000-memory.dmp

Filesize
1.0MB

Download
memory/1916-64-0x0000000000400000-0x000000000045564E-memory.dmp

Filesize
341KB

Download
memory/2024-63-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download