de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Size

408KB
MD5

804f7e1c7072cd940b6ac38d1a791e90
SHA1

4a8462e2902e553a42092dc4edff02c65a04324e
SHA256

de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342
SHA512

31cf51cdd08f602a7fad1c6715b6f17aa9a3fa2292d14fbd5e21504a9806e9d19eed0578267359b69cba6044d4a87b00a4071c56766eca311eb69a3769877100
SSDEEP

6144:p7ouwAH+MCsrXzhFQqgpfevouIJpIMJN/9:pzwAdCsXhFi/HVR

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msng.exe	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
File opened for modification	C:\WINDOWS\SysWOW64\RUNDLL32.EXE	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
File created	C:\Windows\SysWOW64\rundII32.exe	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
File opened for modification	C:\WINDOWS\SysWOW64\EXPLORER.EXE	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
File created	C:\Windows\SysWOW64\msng.exe	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeTakeOwnershipPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeRestorePrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeBackupPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeChangeNotifyPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeTakeOwnershipPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeRestorePrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeBackupPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeChangeNotifyPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeTakeOwnershipPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeRestorePrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeBackupPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeChangeNotifyPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeTakeOwnershipPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeRestorePrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeBackupPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeChangeNotifyPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeTakeOwnershipPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeRestorePrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeBackupPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
Token: SeChangeNotifyPrivilege	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 372	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	5
PID 864 wrote to memory of 372	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	5
PID 864 wrote to memory of 372	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	5
PID 864 wrote to memory of 372	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	5
PID 864 wrote to memory of 372	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	5
PID 864 wrote to memory of 372	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	5
PID 864 wrote to memory of 372	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	5
PID 864 wrote to memory of 384	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	4
PID 864 wrote to memory of 384	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	4
PID 864 wrote to memory of 384	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	4
PID 864 wrote to memory of 384	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	4
PID 864 wrote to memory of 384	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	4
PID 864 wrote to memory of 384	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	4
PID 864 wrote to memory of 384	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	4
PID 864 wrote to memory of 420	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	3
PID 864 wrote to memory of 420	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	3
PID 864 wrote to memory of 420	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	3
PID 864 wrote to memory of 420	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	3
PID 864 wrote to memory of 420	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	3
PID 864 wrote to memory of 420	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	3
PID 864 wrote to memory of 420	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	3
PID 864 wrote to memory of 464	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	2
PID 864 wrote to memory of 464	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	2
PID 864 wrote to memory of 464	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	2
PID 864 wrote to memory of 464	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	2
PID 864 wrote to memory of 464	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	2
PID 864 wrote to memory of 464	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	2
PID 864 wrote to memory of 464	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	2
PID 864 wrote to memory of 480	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	1
PID 864 wrote to memory of 480	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	1
PID 864 wrote to memory of 480	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	1
PID 864 wrote to memory of 480	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	1
PID 864 wrote to memory of 480	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	1
PID 864 wrote to memory of 480	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	1
PID 864 wrote to memory of 480	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	1
PID 864 wrote to memory of 488	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	6
PID 864 wrote to memory of 488	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	6
PID 864 wrote to memory of 488	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	6
PID 864 wrote to memory of 488	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	6
PID 864 wrote to memory of 488	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	6
PID 864 wrote to memory of 488	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	6
PID 864 wrote to memory of 488	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	6
PID 864 wrote to memory of 596	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	23
PID 864 wrote to memory of 596	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	23
PID 864 wrote to memory of 596	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	23
PID 864 wrote to memory of 596	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	23
PID 864 wrote to memory of 596	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	23
PID 864 wrote to memory of 596	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	23
PID 864 wrote to memory of 596	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	23
PID 864 wrote to memory of 672	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	22
PID 864 wrote to memory of 672	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	22
PID 864 wrote to memory of 672	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	22
PID 864 wrote to memory of 672	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	22
PID 864 wrote to memory of 672	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	22
PID 864 wrote to memory of 672	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	22
PID 864 wrote to memory of 672	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	22
PID 864 wrote to memory of 744	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	21
PID 864 wrote to memory of 744	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	21
PID 864 wrote to memory of 744	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	21
PID 864 wrote to memory of 744	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	21
PID 864 wrote to memory of 744	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	21
PID 864 wrote to memory of 744	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	21
PID 864 wrote to memory of 744	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	21
PID 864 wrote to memory of 808	864	de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe	20

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:304
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1560
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:896
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1224
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1048
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:324
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:848
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1644

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe
  "C:\Users\Admin\AppData\Local\Temp\de2fc3969ad536e51215ad695158238f5d3545036db91acdc05125142271f342.exe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:864

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-54-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/864-57-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/864-58-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download