471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 05:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe
Size

682KB
MD5

49e8cd32262585dc8b498d5fea5d5026
SHA1

b1366e5f7405366a18d0c88fcb9343c909817ded
SHA256

471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a
SHA512

6c0b502c47c9fb48f45aeeca429bda7570eac0b51198a9987a5a0b61c4c120492e8ee613271664578ba2b4e1a0c53f664717bcdf7e9c7346857e37a035592f70
SSDEEP

12288:ck1/SPw6gtnqwatn4UVVrXbo82zE2lBFr5zjc:JSPw6gtnqXtn5Vlbo8SVhc

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1464	svchost.exe
5084	SETUP.EXE

Loads dropped DLL 7 IoCs

pid	Process
1464	svchost.exe
1464	svchost.exe
1464	svchost.exe
1464	svchost.exe
1464	svchost.exe
1464	svchost.exe
1464	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\messenger.exe = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Components\\messenger.exe"	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0004000000022dd6-133.dat	nsis_installer_1
behavioral2/files/0x0004000000022dd6-133.dat	nsis_installer_2
behavioral2/files/0x0004000000022dd6-134.dat	nsis_installer_1
behavioral2/files/0x0004000000022dd6-134.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1464	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1464	652	471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe	84
PID 652 wrote to memory of 1464	652	471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe	84
PID 652 wrote to memory of 1464	652	471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe	84
PID 652 wrote to memory of 5084	652	471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe	85
PID 652 wrote to memory of 5084	652	471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe	85
PID 652 wrote to memory of 5084	652	471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe	85

C:\Users\Admin\AppData\Local\Temp\471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe
"C:\Users\Admin\AppData\Local\Temp\471aeb706c27ff0ab49c5543de2027196e710930a756ab5e3f75c3f80ec7813a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\SETUP.EXE
  C:\Users\Admin\AppData\Local\Temp\SETUP.EXE
  2⤵
  - Executes dropped EXE
  PID:5084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SETUP.EXE

Filesize
465KB

MD5
1b3f20a97e9709d3d06087cde7f762fb

SHA1
736cfbeeaec380b1f7ee17704059133b5dedbd5c

SHA256
12e7c6c42e692a5e625c99b524efd6f9e05238e3667ad317a1785155d8b6731d

SHA512
b371a8d49358b1466d3e0199470edd1faa9404719890ec61db2814b9d76449b1c1ba5304415099dfe1237627d7f78fb92e7644839252137f3d88bdace978d7e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP.EXE

Filesize
465KB

MD5
1b3f20a97e9709d3d06087cde7f762fb

SHA1
736cfbeeaec380b1f7ee17704059133b5dedbd5c

SHA256
12e7c6c42e692a5e625c99b524efd6f9e05238e3667ad317a1785155d8b6731d

SHA512
b371a8d49358b1466d3e0199470edd1faa9404719890ec61db2814b9d76449b1c1ba5304415099dfe1237627d7f78fb92e7644839252137f3d88bdace978d7e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgBDE7.tmp\NSISArray.dll

Filesize
19KB

MD5
14b848866035dea39b912da628307231

SHA1
d00c8963aee8038d8a22f098cef69b31007196e5

SHA256
6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc

SHA512
4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgBDE7.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgBDE7.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgBDE7.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgBDE7.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgBDE7.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgBDE7.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
154KB

MD5
024a2fbda97eeed3d5ee557739760c60

SHA1
81f98ba5358b08eab4b83937306364b9160a69e9

SHA256
0bab3a2fafdfd026026ed1f3e689febfff17e61d7f1c23501a5accebc8300119

SHA512
e0fec6e5cb70f3377c5995ed532c29765e98148fa9892707c72614392b557a50d3cf5fb20932443b166e2be09950b2aa77d899c34a36339c508e8d7d1e6b154f

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
154KB

MD5
024a2fbda97eeed3d5ee557739760c60

SHA1
81f98ba5358b08eab4b83937306364b9160a69e9

SHA256
0bab3a2fafdfd026026ed1f3e689febfff17e61d7f1c23501a5accebc8300119

SHA512
e0fec6e5cb70f3377c5995ed532c29765e98148fa9892707c72614392b557a50d3cf5fb20932443b166e2be09950b2aa77d899c34a36339c508e8d7d1e6b154f

Download Submit
memory/1464-141-0x0000000003FA1000-0x0000000003FA4000-memory.dmp

Filesize
12KB

Download
memory/1464-144-0x0000000002BC1000-0x0000000002BC4000-memory.dmp

Filesize
12KB

Download