Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2022, 03:45
Behavioral task
behavioral1
Sample
dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
General
-
Target
dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe
-
Size
298KB
-
MD5
44d28d242d803063195f05bfb5b49110
-
SHA1
b48838867b9e26124ef4866edb5d5eb5261cf700
-
SHA256
dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede
-
SHA512
4ef8d76665d663df072e294efbc50ac2f35eaa72dc1599f5b036f8dc1d825d02c70d7c71d81df97e85bbe06e45da078e09bb8437c15f3bed334ef5a9601ae835
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYC:v6Wq4aaE6KwyF5L0Y2D1PqL/
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2368 svhost.exe -
resource yara_rule behavioral2/memory/864-132-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x000300000001e64d-134.dat upx behavioral2/files/0x000300000001e64d-135.dat upx behavioral2/memory/2368-136-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/864-137-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2368-138-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\f: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\s: svhost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/864-132-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/864-137-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2368-138-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Driver.db svhost.exe File created C:\Windows\svhost.exe dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2368 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 2368 svhost.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 2368 svhost.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe 2368 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 864 wrote to memory of 2368 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 81 PID 864 wrote to memory of 2368 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 81 PID 864 wrote to memory of 2368 864 dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe"C:\Users\Admin\AppData\Local\Temp\dad96eabbb6414b690b8c8e801cd3e8653cfc226868c3f1e3bbe9d211ddf1ede.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2368
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299KB
MD5fcb51000ef132bde6094d4a6b181ddb2
SHA1946bf9318f44c9e27bbb3cf56cb0f1103638c5b2
SHA2563f8c414d41a5b862c6adeee16555fb517d4a50f16f027a07953567796610721c
SHA512469f1b499c4ca01108e7905a06756bc5cf485845a8482bd3a669aa3fb3df1cc4ea75ce13722c8096c0f00ee7863410e9240ee7a6c1cfbd47a437532116443d0c
-
Filesize
299KB
MD5fcb51000ef132bde6094d4a6b181ddb2
SHA1946bf9318f44c9e27bbb3cf56cb0f1103638c5b2
SHA2563f8c414d41a5b862c6adeee16555fb517d4a50f16f027a07953567796610721c
SHA512469f1b499c4ca01108e7905a06756bc5cf485845a8482bd3a669aa3fb3df1cc4ea75ce13722c8096c0f00ee7863410e9240ee7a6c1cfbd47a437532116443d0c