Analysis
-
max time kernel
86s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
23-10-2022 23:24
General
-
Target
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe
-
Size
225KB
-
MD5
e86b3398333384aaffd32c1444dde9d0
-
SHA1
4ed7e2362fb149e5d5c3a261400f1e6e6f04628d
-
SHA256
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33
-
SHA512
eb9c20f2610d2ff008dd3d7a0596ef5ada56b2c121bf635eb8247a049b829f947b0a514c0052399e47662a526325b3b9e8c916c009f42d5279e90040a28932ec
-
SSDEEP
3072:dieIAGyEGGmgvevzpxBt0uZ8z43gBVN2qvI6vQF5ovTsno:d5qedM43wVN2g3gno
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe"C:\Users\Admin\AppData\Local\Temp\435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C732AD79-2676-4478-8324-E2E272CAF080}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C732AD79-2676-4478-8324-E2E272CAF080}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45550C23-6DFB-4834-9ABC-F675394A6854}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45550C23-6DFB-4834-9ABC-F675394A6854}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F6938AA3-B544-40A1-A284-715405CED94A}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F6938AA3-B544-40A1-A284-715405CED94A}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8853E473-3443-449E-AAF8-26AC0385AFF7}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8853E473-3443-449E-AAF8-26AC0385AFF7}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32414A6B-2923-454B-A3BB-E9B00E9B2986}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32414A6B-2923-454B-A3BB-E9B00E9B2986}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BCF16990-7DF6-4662-9B38-824EDB783776}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BCF16990-7DF6-4662-9B38-824EDB783776}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{027188E6-24B0-4B24-9D58-D7193261822A}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{027188E6-24B0-4B24-9D58-D7193261822A}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D681C056-F0A9-42F1-85A2-F1D5A0FE4CCE}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D681C056-F0A9-42F1-85A2-F1D5A0FE4CCE}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B5943E2F-FD3F-483F-BBA5-85D18C020F6E}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B5943E2F-FD3F-483F-BBA5-85D18C020F6E}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7929D406-7E7D-435F-B083-B0D09E608D4F}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7929D406-7E7D-435F-B083-B0D09E608D4F}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{36515C56-E730-408F-82A1-A9626EFDC2F1}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{36515C56-E730-408F-82A1-A9626EFDC2F1}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{87213D3E-FD2A-47BF-8D96-3FF4F798C525}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{87213D3E-FD2A-47BF-8D96-3FF4F798C525}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7A8C3DC0-DEAE-40C7-934A-660B3554D3C6}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7A8C3DC0-DEAE-40C7-934A-660B3554D3C6}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4AF679B-8326-4DC6-B011-7C01D31BB82B}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4AF679B-8326-4DC6-B011-7C01D31BB82B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4D32BA93-B973-4E0C-9F15-8428C9A8DFB3}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4D32BA93-B973-4E0C-9F15-8428C9A8DFB3}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{72BDF867-2970-424B-9779-B003388921BA}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{72BDF867-2970-424B-9779-B003388921BA}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3D7B6E54-2B77-45E2-BB4D-141B0CA58407}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3D7B6E54-2B77-45E2-BB4D-141B0CA58407}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AD0465AE-A9BC-47E2-828C-9B0AD88BD954}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AD0465AE-A9BC-47E2-828C-9B0AD88BD954}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/304-78-0x0000000000000000-mapping.dmp
-
memory/552-87-0x0000000000000000-mapping.dmp
-
memory/552-60-0x0000000000000000-mapping.dmp
-
memory/556-79-0x0000000000000000-mapping.dmp
-
memory/596-73-0x0000000000000000-mapping.dmp
-
memory/624-75-0x0000000000000000-mapping.dmp
-
memory/820-88-0x0000000000000000-mapping.dmp
-
memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/856-67-0x0000000000000000-mapping.dmp
-
memory/892-55-0x0000000000000000-mapping.dmp
-
memory/948-84-0x0000000000000000-mapping.dmp
-
memory/996-76-0x0000000000000000-mapping.dmp
-
memory/1056-77-0x0000000000000000-mapping.dmp
-
memory/1064-71-0x0000000000000000-mapping.dmp
-
memory/1120-89-0x0000000000000000-mapping.dmp
-
memory/1144-65-0x0000000000000000-mapping.dmp
-
memory/1168-80-0x0000000000000000-mapping.dmp
-
memory/1364-63-0x0000000000000000-mapping.dmp
-
memory/1380-69-0x0000000000000000-mapping.dmp
-
memory/1384-66-0x0000000000000000-mapping.dmp
-
memory/1456-83-0x0000000000000000-mapping.dmp
-
memory/1476-57-0x0000000000000000-mapping.dmp
-
memory/1512-59-0x0000000000000000-mapping.dmp
-
memory/1516-82-0x0000000000000000-mapping.dmp
-
memory/1564-70-0x0000000000000000-mapping.dmp
-
memory/1724-86-0x0000000000000000-mapping.dmp
-
memory/1736-74-0x0000000000000000-mapping.dmp
-
memory/1744-72-0x0000000000000000-mapping.dmp
-
memory/1752-62-0x0000000000000000-mapping.dmp
-
memory/1756-61-0x0000000000000000-mapping.dmp
-
memory/1760-81-0x0000000000000000-mapping.dmp
-
memory/1772-85-0x0000000000000000-mapping.dmp
-
memory/1856-68-0x0000000000000000-mapping.dmp
-
memory/1860-56-0x0000000000000000-mapping.dmp
-
memory/1916-58-0x0000000000000000-mapping.dmp
-
memory/2008-64-0x0000000000000000-mapping.dmp