Analysis
-
max time kernel
12s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 22:49
Static task
static1
Behavioral task
behavioral1
Sample
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe
Resource
win7-20220812-en
General
-
Target
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe
-
Size
56KB
-
MD5
2c72f3642a2b4e17e8f54d4a8782c7f5
-
SHA1
55e76b2348a1affccc66df9389aae8b5d39d6c03
-
SHA256
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90
-
SHA512
739bcf49f3c5250baaffe20d175e351192d612ef4f1774b71727529b425d809f2fcc2e1b7cce5124baebcd8979b1c599a7d6017ec6aaca086aeca57ee5004000
-
SSDEEP
768:ITlH3i10e6PQ5WKwl0JRGdGo3DhSZhmE2fI8+ZNX:UlHy1bsKwqJGGoGhmpfIfN
Malware Config
Signatures
-
Processes:
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exee09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
k4.exek4.exek4.exek4.exepid process 1772 k4.exe 1996 k4.exe 1772 k4.exe 1996 k4.exe -
Loads dropped DLL 2 IoCs
Processes:
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exee09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exepid process 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe -
Processes:
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exee09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1524 taskkill.exe 1524 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
taskkill.exek4.exetaskkill.exek4.exedescription pid process Token: SeDebugPrivilege 1524 taskkill.exe Token: SeLoadDriverPrivilege 1996 k4.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeLoadDriverPrivilege 1996 k4.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exee09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exepid process 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.execmd.exee09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.execmd.exedescription pid process target process PID 1660 wrote to memory of 1772 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1772 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1772 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1772 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1996 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1996 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1996 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1996 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 824 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe cmd.exe PID 1660 wrote to memory of 824 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe cmd.exe PID 1660 wrote to memory of 824 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe cmd.exe PID 1660 wrote to memory of 824 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe cmd.exe PID 824 wrote to memory of 1524 824 cmd.exe taskkill.exe PID 824 wrote to memory of 1524 824 cmd.exe taskkill.exe PID 824 wrote to memory of 1524 824 cmd.exe taskkill.exe PID 824 wrote to memory of 1524 824 cmd.exe taskkill.exe PID 1660 wrote to memory of 1772 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1772 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1772 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1772 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1996 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1996 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1996 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 1996 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe k4.exe PID 1660 wrote to memory of 824 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe cmd.exe PID 1660 wrote to memory of 824 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe cmd.exe PID 1660 wrote to memory of 824 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe cmd.exe PID 1660 wrote to memory of 824 1660 e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe cmd.exe PID 824 wrote to memory of 1524 824 cmd.exe taskkill.exe PID 824 wrote to memory of 1524 824 cmd.exe taskkill.exe PID 824 wrote to memory of 1524 824 cmd.exe taskkill.exe PID 824 wrote to memory of 1524 824 cmd.exe taskkill.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exee09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe"C:\Users\Admin\AppData\Local\Temp\e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im k4.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe"C:\Users\Admin\AppData\Local\Temp\e09d36724c02199b6e92a6ff74f3f3fb5f48c0ee4cc66547e97b18dc488fbe90.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im k4.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
memory/824-63-0x0000000000000000-mapping.dmp
-
memory/824-63-0x0000000000000000-mapping.dmp
-
memory/1524-64-0x0000000000000000-mapping.dmp
-
memory/1524-64-0x0000000000000000-mapping.dmp
-
memory/1660-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1660-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1772-56-0x0000000000000000-mapping.dmp
-
memory/1772-58-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmpFilesize
8KB
-
memory/1772-58-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmpFilesize
8KB
-
memory/1772-56-0x0000000000000000-mapping.dmp
-
memory/1996-60-0x0000000000000000-mapping.dmp
-
memory/1996-60-0x0000000000000000-mapping.dmp