Analysis
-
max time kernel
152s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-10-2022 03:46
Static task
static1
Behavioral task
behavioral1
Sample
cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe
Resource
win10v2004-20220901-en
General
-
Target
cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe
-
Size
201KB
-
MD5
52af237493a34f17545b4886bdfb6df0
-
SHA1
e8c8a1f882456d04a847c3a4fc6fe085cfc37d47
-
SHA256
cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432
-
SHA512
f21efbc699b38f78be85ca2f242976d283992f9123a7b1390a6981948f9bc33e191d3706ea1ce85c2cd86c9eb1582d68c3b2d9a94dfb3c9c195d27bd7ffd1a6e
-
SSDEEP
6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtF+:HqEjk7l7F+
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1764 security.exe 1132 security.exe -
resource yara_rule behavioral1/memory/1524-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1524-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1524-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1524-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1524-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1524-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1524-108-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1132-110-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1132-112-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 5 IoCs
pid Process 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\security.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 996 set thread context of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 1764 set thread context of 1132 1764 security.exe 32 PID 1764 set thread context of 820 1764 security.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe Token: SeDebugPrivilege 1132 security.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 1764 security.exe 1132 security.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 996 wrote to memory of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 996 wrote to memory of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 996 wrote to memory of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 996 wrote to memory of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 996 wrote to memory of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 996 wrote to memory of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 996 wrote to memory of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 996 wrote to memory of 1524 996 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 27 PID 1524 wrote to memory of 1200 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 28 PID 1524 wrote to memory of 1200 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 28 PID 1524 wrote to memory of 1200 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 28 PID 1524 wrote to memory of 1200 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 28 PID 1200 wrote to memory of 1976 1200 cmd.exe 30 PID 1200 wrote to memory of 1976 1200 cmd.exe 30 PID 1200 wrote to memory of 1976 1200 cmd.exe 30 PID 1200 wrote to memory of 1976 1200 cmd.exe 30 PID 1524 wrote to memory of 1764 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 31 PID 1524 wrote to memory of 1764 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 31 PID 1524 wrote to memory of 1764 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 31 PID 1524 wrote to memory of 1764 1524 cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe 31 PID 1764 wrote to memory of 1132 1764 security.exe 32 PID 1764 wrote to memory of 1132 1764 security.exe 32 PID 1764 wrote to memory of 1132 1764 security.exe 32 PID 1764 wrote to memory of 1132 1764 security.exe 32 PID 1764 wrote to memory of 1132 1764 security.exe 32 PID 1764 wrote to memory of 1132 1764 security.exe 32 PID 1764 wrote to memory of 1132 1764 security.exe 32 PID 1764 wrote to memory of 1132 1764 security.exe 32 PID 1764 wrote to memory of 820 1764 security.exe 33 PID 1764 wrote to memory of 820 1764 security.exe 33 PID 1764 wrote to memory of 820 1764 security.exe 33 PID 1764 wrote to memory of 820 1764 security.exe 33 PID 1764 wrote to memory of 820 1764 security.exe 33 PID 1764 wrote to memory of 820 1764 security.exe 33 PID 1764 wrote to memory of 820 1764 security.exe 33 PID 1764 wrote to memory of 820 1764 security.exe 33 PID 1764 wrote to memory of 820 1764 security.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe"C:\Users\Admin\AppData\Local\Temp\cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe"C:\Users\Admin\AppData\Local\Temp\cf574243c6f10df0e814e9a8d764e480a12fadb80944f62a0538114a7b839432.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ITJFE.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f4⤵
- Adds Run key to start application
PID:1976
-
-
-
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1132
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵PID:820
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD56f473a1ba53e043362047f72e20b34f4
SHA1e8f121a589e1207ed950453376ee1d21b1223835
SHA2565fbce2c77a90ba9edbcf60be3851ab81633b7c10b1babb624d475c7be589de4b
SHA512b4976d40bc708ae6cddf367a5382cd532e4cf235b848cdaa4e4d317e06d9126e50745a7772591bc21dc7380689f4399e57501b0aa73cd231bce32e22d53b0818
-
Filesize
201KB
MD5d0c3fdff8fc5afac5f4be6cce163390c
SHA138df9f21bc40e0a5e88ef7aed4f7749de9e6c8ba
SHA2568fb85ea16fdc09797cbcece959efed4bafe74bb740bc7fc79242c26382c21fa9
SHA512e543413dfe9aee2591b68b3d08e30bbeba842b27ed6529adc719b54e6f387cf3341d6a8e88566519f875e44fb21436211f2b074883d4a7c726b9ad446618ef0c
-
Filesize
201KB
MD5d0c3fdff8fc5afac5f4be6cce163390c
SHA138df9f21bc40e0a5e88ef7aed4f7749de9e6c8ba
SHA2568fb85ea16fdc09797cbcece959efed4bafe74bb740bc7fc79242c26382c21fa9
SHA512e543413dfe9aee2591b68b3d08e30bbeba842b27ed6529adc719b54e6f387cf3341d6a8e88566519f875e44fb21436211f2b074883d4a7c726b9ad446618ef0c
-
Filesize
201KB
MD5d0c3fdff8fc5afac5f4be6cce163390c
SHA138df9f21bc40e0a5e88ef7aed4f7749de9e6c8ba
SHA2568fb85ea16fdc09797cbcece959efed4bafe74bb740bc7fc79242c26382c21fa9
SHA512e543413dfe9aee2591b68b3d08e30bbeba842b27ed6529adc719b54e6f387cf3341d6a8e88566519f875e44fb21436211f2b074883d4a7c726b9ad446618ef0c
-
Filesize
201KB
MD5d0c3fdff8fc5afac5f4be6cce163390c
SHA138df9f21bc40e0a5e88ef7aed4f7749de9e6c8ba
SHA2568fb85ea16fdc09797cbcece959efed4bafe74bb740bc7fc79242c26382c21fa9
SHA512e543413dfe9aee2591b68b3d08e30bbeba842b27ed6529adc719b54e6f387cf3341d6a8e88566519f875e44fb21436211f2b074883d4a7c726b9ad446618ef0c
-
Filesize
201KB
MD5d0c3fdff8fc5afac5f4be6cce163390c
SHA138df9f21bc40e0a5e88ef7aed4f7749de9e6c8ba
SHA2568fb85ea16fdc09797cbcece959efed4bafe74bb740bc7fc79242c26382c21fa9
SHA512e543413dfe9aee2591b68b3d08e30bbeba842b27ed6529adc719b54e6f387cf3341d6a8e88566519f875e44fb21436211f2b074883d4a7c726b9ad446618ef0c
-
Filesize
201KB
MD5d0c3fdff8fc5afac5f4be6cce163390c
SHA138df9f21bc40e0a5e88ef7aed4f7749de9e6c8ba
SHA2568fb85ea16fdc09797cbcece959efed4bafe74bb740bc7fc79242c26382c21fa9
SHA512e543413dfe9aee2591b68b3d08e30bbeba842b27ed6529adc719b54e6f387cf3341d6a8e88566519f875e44fb21436211f2b074883d4a7c726b9ad446618ef0c
-
Filesize
201KB
MD5d0c3fdff8fc5afac5f4be6cce163390c
SHA138df9f21bc40e0a5e88ef7aed4f7749de9e6c8ba
SHA2568fb85ea16fdc09797cbcece959efed4bafe74bb740bc7fc79242c26382c21fa9
SHA512e543413dfe9aee2591b68b3d08e30bbeba842b27ed6529adc719b54e6f387cf3341d6a8e88566519f875e44fb21436211f2b074883d4a7c726b9ad446618ef0c
-
Filesize
201KB
MD5d0c3fdff8fc5afac5f4be6cce163390c
SHA138df9f21bc40e0a5e88ef7aed4f7749de9e6c8ba
SHA2568fb85ea16fdc09797cbcece959efed4bafe74bb740bc7fc79242c26382c21fa9
SHA512e543413dfe9aee2591b68b3d08e30bbeba842b27ed6529adc719b54e6f387cf3341d6a8e88566519f875e44fb21436211f2b074883d4a7c726b9ad446618ef0c