Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-10-2022 22:30
Static task
static1
Behavioral task
behavioral1
Sample
082468775e71a0573a6d1b7b9707b223.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
082468775e71a0573a6d1b7b9707b223.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
082468775e71a0573a6d1b7b9707b223.exe
-
Size
186KB
-
MD5
082468775e71a0573a6d1b7b9707b223
-
SHA1
f505f7bf8fd71f4fd520734e97b2dcd0a0363ed0
-
SHA256
1931ee3bb9562721ab65d6643d51c2b37879ed3347c1e96a3d27865c8e3d355a
-
SHA512
f73109d944266e4be46a6829e3eb07fa7210b6a0f310e2a5d2a45955b780a223a5fc9b9a11cfe56eddc6b775dff9f181c6e3be8929c74475ec3e933039373079
-
SSDEEP
3072:PAUr6milNYXJb3r7lkKgy6bgXBA8Ug6JPaJHiTsPrcqZH2FZxzqY6FKVwgeYENV:4h7iXJb3f8RgbUJCAuH2FZRqY6FKVwgq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 740 svchost.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1672 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9f142b90526f8362621e21d115640fc1.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9f142b90526f8362621e21d115640fc1.exe svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 2020 082468775e71a0573a6d1b7b9707b223.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\9f142b90526f8362621e21d115640fc1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9f142b90526f8362621e21d115640fc1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf svchost.exe File opened for modification C:\autorun.inf svchost.exe File created D:\autorun.inf svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 928 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe 740 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 740 svchost.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 740 svchost.exe Token: SeDebugPrivilege 928 taskkill.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe Token: 33 740 svchost.exe Token: SeIncBasePriorityPrivilege 740 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2020 wrote to memory of 740 2020 082468775e71a0573a6d1b7b9707b223.exe 26 PID 2020 wrote to memory of 740 2020 082468775e71a0573a6d1b7b9707b223.exe 26 PID 2020 wrote to memory of 740 2020 082468775e71a0573a6d1b7b9707b223.exe 26 PID 2020 wrote to memory of 740 2020 082468775e71a0573a6d1b7b9707b223.exe 26 PID 740 wrote to memory of 1672 740 svchost.exe 27 PID 740 wrote to memory of 1672 740 svchost.exe 27 PID 740 wrote to memory of 1672 740 svchost.exe 27 PID 740 wrote to memory of 1672 740 svchost.exe 27 PID 740 wrote to memory of 928 740 svchost.exe 29 PID 740 wrote to memory of 928 740 svchost.exe 29 PID 740 wrote to memory of 928 740 svchost.exe 29 PID 740 wrote to memory of 928 740 svchost.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\082468775e71a0573a6d1b7b9707b223.exe"C:\Users\Admin\AppData\Local\Temp\082468775e71a0573a6d1b7b9707b223.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM AvastUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD5082468775e71a0573a6d1b7b9707b223
SHA1f505f7bf8fd71f4fd520734e97b2dcd0a0363ed0
SHA2561931ee3bb9562721ab65d6643d51c2b37879ed3347c1e96a3d27865c8e3d355a
SHA512f73109d944266e4be46a6829e3eb07fa7210b6a0f310e2a5d2a45955b780a223a5fc9b9a11cfe56eddc6b775dff9f181c6e3be8929c74475ec3e933039373079
-
Filesize
186KB
MD5082468775e71a0573a6d1b7b9707b223
SHA1f505f7bf8fd71f4fd520734e97b2dcd0a0363ed0
SHA2561931ee3bb9562721ab65d6643d51c2b37879ed3347c1e96a3d27865c8e3d355a
SHA512f73109d944266e4be46a6829e3eb07fa7210b6a0f310e2a5d2a45955b780a223a5fc9b9a11cfe56eddc6b775dff9f181c6e3be8929c74475ec3e933039373079
-
Filesize
186KB
MD5082468775e71a0573a6d1b7b9707b223
SHA1f505f7bf8fd71f4fd520734e97b2dcd0a0363ed0
SHA2561931ee3bb9562721ab65d6643d51c2b37879ed3347c1e96a3d27865c8e3d355a
SHA512f73109d944266e4be46a6829e3eb07fa7210b6a0f310e2a5d2a45955b780a223a5fc9b9a11cfe56eddc6b775dff9f181c6e3be8929c74475ec3e933039373079