Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 00:41
Static task
static1
Behavioral task
behavioral1
Sample
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
Resource
win10v2004-20220812-en
General
-
Target
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
-
Size
293KB
-
MD5
6e991b3a1fece5eca1245671278fe7b3
-
SHA1
59488e5bb50f50de0918ed6502dde596d8d14b63
-
SHA256
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186
-
SHA512
6fda298d1abf38aca349c9ed304bf93548727135d6d47e14bef0d8b6aac584f3efdd368f44d081411b7f5710c9587776c92a49772e49e542f8820bd1a32f8489
-
SSDEEP
6144:O6vwPu/iIbHm3RYS3ijVmkb30esF+eBYlyMioctl:FwPRUHUOS3ipmkb30j8dld7I
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exepid process 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1312 cmd.exe -
Loads dropped DLL 4 IoCs
Processes:
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exetaskmgr.exepid process 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 1960 taskmgr.exe 1960 taskmgr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\\Windows\\explorer.exe" 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\Windows\\explorer.exe" 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exetaskmgr.exepid process 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exepid process 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe Token: SeDebugPrivilege 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe Token: SeDebugPrivilege 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe Token: SeDebugPrivilege 1960 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exepid process 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.execmd.exedescription pid process target process PID 1184 wrote to memory of 1956 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe PID 1184 wrote to memory of 1956 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe PID 1184 wrote to memory of 1956 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe PID 1184 wrote to memory of 1956 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe PID 1184 wrote to memory of 1312 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe cmd.exe PID 1184 wrote to memory of 1312 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe cmd.exe PID 1184 wrote to memory of 1312 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe cmd.exe PID 1184 wrote to memory of 1312 1184 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe cmd.exe PID 1956 wrote to memory of 1960 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe taskmgr.exe PID 1956 wrote to memory of 1960 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe taskmgr.exe PID 1956 wrote to memory of 1960 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe taskmgr.exe PID 1956 wrote to memory of 1960 1956 535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe taskmgr.exe PID 1312 wrote to memory of 520 1312 cmd.exe PING.EXE PID 1312 wrote to memory of 520 1312 cmd.exe PING.EXE PID 1312 wrote to memory of 520 1312 cmd.exe PING.EXE PID 1312 wrote to memory of 520 1312 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe"C:\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe"C:\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1960 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
Filesize293KB
MD56e991b3a1fece5eca1245671278fe7b3
SHA159488e5bb50f50de0918ed6502dde596d8d14b63
SHA256535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186
SHA5126fda298d1abf38aca349c9ed304bf93548727135d6d47e14bef0d8b6aac584f3efdd368f44d081411b7f5710c9587776c92a49772e49e542f8820bd1a32f8489
-
C:\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
Filesize293KB
MD56e991b3a1fece5eca1245671278fe7b3
SHA159488e5bb50f50de0918ed6502dde596d8d14b63
SHA256535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186
SHA5126fda298d1abf38aca349c9ed304bf93548727135d6d47e14bef0d8b6aac584f3efdd368f44d081411b7f5710c9587776c92a49772e49e542f8820bd1a32f8489
-
\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
Filesize293KB
MD56e991b3a1fece5eca1245671278fe7b3
SHA159488e5bb50f50de0918ed6502dde596d8d14b63
SHA256535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186
SHA5126fda298d1abf38aca349c9ed304bf93548727135d6d47e14bef0d8b6aac584f3efdd368f44d081411b7f5710c9587776c92a49772e49e542f8820bd1a32f8489
-
\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
Filesize293KB
MD56e991b3a1fece5eca1245671278fe7b3
SHA159488e5bb50f50de0918ed6502dde596d8d14b63
SHA256535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186
SHA5126fda298d1abf38aca349c9ed304bf93548727135d6d47e14bef0d8b6aac584f3efdd368f44d081411b7f5710c9587776c92a49772e49e542f8820bd1a32f8489
-
\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
Filesize293KB
MD56e991b3a1fece5eca1245671278fe7b3
SHA159488e5bb50f50de0918ed6502dde596d8d14b63
SHA256535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186
SHA5126fda298d1abf38aca349c9ed304bf93548727135d6d47e14bef0d8b6aac584f3efdd368f44d081411b7f5710c9587776c92a49772e49e542f8820bd1a32f8489
-
\Users\Admin\AppData\Local\Temp\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186\535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186.exe
Filesize293KB
MD56e991b3a1fece5eca1245671278fe7b3
SHA159488e5bb50f50de0918ed6502dde596d8d14b63
SHA256535297fa7ca0a25bae29a97591892b19f6501300d04fb791f4cdf1e68443e186
SHA5126fda298d1abf38aca349c9ed304bf93548727135d6d47e14bef0d8b6aac584f3efdd368f44d081411b7f5710c9587776c92a49772e49e542f8820bd1a32f8489