Analysis
-
max time kernel
52s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/10/2022, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe
-
Size
393KB
-
MD5
113ee6cc8ba382d67563a57dbce7a1c0
-
SHA1
4b45203102757e602dda09b6f332cb9232b79ded
-
SHA256
ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6
-
SHA512
b52cbc47963b328e1ef886a7bb9ff65884bb02f58d5f13d43d4e3922a4209ed96fc9cf89749fe4a4952e0fcbbea35a985e798302565a4190b92bbb9c7d24067a
-
SSDEEP
6144:Z/0qTn9J4LmDuvayK1Gqzma8CnXfCeIDudLCAFbZlS:6qTn9umDuvavHmrCGDgtHS
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sychost.exe" ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sychost.exe ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Windows\SysWOW64\sychost.exe ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe -
Drops file in Program Files directory 58 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\az.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\History.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\7z.exe ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 616 1976 WerFault.exe 25 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1976 ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe 1976 ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe 1976 ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 616 1976 ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe 28 PID 1976 wrote to memory of 616 1976 ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe 28 PID 1976 wrote to memory of 616 1976 ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe 28 PID 1976 wrote to memory of 616 1976 ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe"C:\Users\Admin\AppData\Local\Temp\ab5ca00bfd0fff567960f09214e25a530ca96744b69164f3b7f51d0973d4fae6.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 9322⤵
- Program crash
PID:616
-