Overview

overview

8

Static

static

435a917a2a...in.exe

windows7-x64

8

435a917a2a...in.exe

windows10-2004-x64

8

Resubmissions

27-10-2022 16:11

221027-tm2pvacfh9 10

23-10-2022 23:24

221023-3d7deadchp 8

Analysis

  • max time kernel
    86s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-10-2022 23:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe

  • Size

    225KB

  • MD5

    e86b3398333384aaffd32c1444dde9d0

  • SHA1

    4ed7e2362fb149e5d5c3a261400f1e6e6f04628d

  • SHA256

    435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33

  • SHA512

    eb9c20f2610d2ff008dd3d7a0596ef5ada56b2c121bf635eb8247a049b829f947b0a514c0052399e47662a526325b3b9e8c916c009f42d5279e90040a28932ec

  • SSDEEP

    3072:dieIAGyEGGmgvevzpxBt0uZ8z43gBVN2qvI6vQF5ovTsno:d5qedM43wVN2g3gno

Score
8/10
ransomwarespywarestealer

Malware Config

Signatures

  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 46 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C732AD79-2676-4478-8324-E2E272CAF080}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:892
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C732AD79-2676-4478-8324-E2E272CAF080}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1860
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45550C23-6DFB-4834-9ABC-F675394A6854}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45550C23-6DFB-4834-9ABC-F675394A6854}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1916
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F6938AA3-B544-40A1-A284-715405CED94A}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F6938AA3-B544-40A1-A284-715405CED94A}'" delete
        3⤵
          PID:552
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8853E473-3443-449E-AAF8-26AC0385AFF7}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8853E473-3443-449E-AAF8-26AC0385AFF7}'" delete
          3⤵
            PID:1752
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32414A6B-2923-454B-A3BB-E9B00E9B2986}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32414A6B-2923-454B-A3BB-E9B00E9B2986}'" delete
            3⤵
              PID:2008
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BCF16990-7DF6-4662-9B38-824EDB783776}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1144
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BCF16990-7DF6-4662-9B38-824EDB783776}'" delete
              3⤵
                PID:1384
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{027188E6-24B0-4B24-9D58-D7193261822A}'" delete
              2⤵
                PID:856
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{027188E6-24B0-4B24-9D58-D7193261822A}'" delete
                  3⤵
                    PID:1652
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D681C056-F0A9-42F1-85A2-F1D5A0FE4CCE}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1856
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D681C056-F0A9-42F1-85A2-F1D5A0FE4CCE}'" delete
                    3⤵
                      PID:1380
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B5943E2F-FD3F-483F-BBA5-85D18C020F6E}'" delete
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1564
                    • C:\Windows\System32\wbem\WMIC.exe
                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B5943E2F-FD3F-483F-BBA5-85D18C020F6E}'" delete
                      3⤵
                        PID:1064
                    • C:\Windows\system32\cmd.exe
                      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7929D406-7E7D-435F-B083-B0D09E608D4F}'" delete
                      2⤵
                        PID:1744
                        • C:\Windows\System32\wbem\WMIC.exe
                          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7929D406-7E7D-435F-B083-B0D09E608D4F}'" delete
                          3⤵
                            PID:596
                        • C:\Windows\system32\cmd.exe
                          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{36515C56-E730-408F-82A1-A9626EFDC2F1}'" delete
                          2⤵
                            PID:1736
                            • C:\Windows\System32\wbem\WMIC.exe
                              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{36515C56-E730-408F-82A1-A9626EFDC2F1}'" delete
                              3⤵
                                PID:624
                            • C:\Windows\system32\cmd.exe
                              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{87213D3E-FD2A-47BF-8D96-3FF4F798C525}'" delete
                              2⤵
                                PID:996
                                • C:\Windows\System32\wbem\WMIC.exe
                                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{87213D3E-FD2A-47BF-8D96-3FF4F798C525}'" delete
                                  3⤵
                                    PID:1056
                                • C:\Windows\system32\cmd.exe
                                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7A8C3DC0-DEAE-40C7-934A-660B3554D3C6}'" delete
                                  2⤵
                                    PID:304
                                    • C:\Windows\System32\wbem\WMIC.exe
                                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7A8C3DC0-DEAE-40C7-934A-660B3554D3C6}'" delete
                                      3⤵
                                        PID:556
                                    • C:\Windows\system32\cmd.exe
                                      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4AF679B-8326-4DC6-B011-7C01D31BB82B}'" delete
                                      2⤵
                                        PID:1168
                                        • C:\Windows\System32\wbem\WMIC.exe
                                          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4AF679B-8326-4DC6-B011-7C01D31BB82B}'" delete
                                          3⤵
                                            PID:1760
                                        • C:\Windows\system32\cmd.exe
                                          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4D32BA93-B973-4E0C-9F15-8428C9A8DFB3}'" delete
                                          2⤵
                                            PID:1516
                                            • C:\Windows\System32\wbem\WMIC.exe
                                              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4D32BA93-B973-4E0C-9F15-8428C9A8DFB3}'" delete
                                              3⤵
                                                PID:1456
                                            • C:\Windows\system32\cmd.exe
                                              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{72BDF867-2970-424B-9779-B003388921BA}'" delete
                                              2⤵
                                                PID:948
                                                • C:\Windows\System32\wbem\WMIC.exe
                                                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{72BDF867-2970-424B-9779-B003388921BA}'" delete
                                                  3⤵
                                                    PID:1772
                                                • C:\Windows\system32\cmd.exe
                                                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3D7B6E54-2B77-45E2-BB4D-141B0CA58407}'" delete
                                                  2⤵
                                                    PID:1724
                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3D7B6E54-2B77-45E2-BB4D-141B0CA58407}'" delete
                                                      3⤵
                                                        PID:552
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AD0465AE-A9BC-47E2-828C-9B0AD88BD954}'" delete
                                                      2⤵
                                                        PID:820
                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AD0465AE-A9BC-47E2-828C-9B0AD88BD954}'" delete
                                                          3⤵
                                                            PID:1120
                                                      • C:\Windows\system32\vssvc.exe
                                                        C:\Windows\system32\vssvc.exe
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:276

                                                      Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • memory/304-78-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/552-87-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/552-60-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/556-79-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/596-73-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/624-75-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/820-88-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/856-67-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/892-55-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/948-84-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/996-76-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1056-77-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1064-71-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1120-89-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1144-65-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1168-80-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1364-63-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1380-69-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1384-66-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1456-83-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1476-57-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1512-59-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1516-82-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1564-70-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1724-86-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1736-74-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1744-72-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1752-62-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1756-61-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1760-81-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1772-85-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1856-68-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1860-56-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/1916-58-0x0000000000000000-mapping.dmp

                                                        Download

                                                      • memory/2008-64-0x0000000000000000-mapping.dmp

                                                        Download