44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e

Analysis

max time kernel
151s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
Size

40KB
MD5

8f6ec13797993eaa51df4b5d6641cbc0
SHA1

489ac1bef91044ab1240a57bd03006b6766f0c95
SHA256

44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e
SHA512

2bfb6cad5398815e3db7a52a97b1d1caf0c3069ee1d361ffae0e26f8cf7ce7e0740cc5f48d4f1256ca53a900952fa139c23698cc69e64e17d3d7e77b2ad499d1
SSDEEP

768:tbmfIz1XCBFti56OpY9x0dHXOHk3CCecGH9C/vc:t3zkFti56IY9x6w4RCsvc

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Admin.exe

Executes dropped EXE 1 IoCs

pid	Process
1352	Admin.exe

Loads dropped DLL 2 IoCs

pid	Process
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	Admin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1352	Admin.exe
1352	Admin.exe
1352	Admin.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
1352	Admin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1352	1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe	26
PID 1976 wrote to memory of 1352	1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe	26
PID 1976 wrote to memory of 1352	1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe	26
PID 1976 wrote to memory of 1352	1976	44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe	26

C:\Users\Admin\AppData\Local\Temp\44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe
"C:\Users\Admin\AppData\Local\Temp\44b596d15dcf09d9e421f3bd13f80dd6c342d7d549e0bda9d624c35aa28fc34e.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\Admin.exe
  "C:\Users\Admin\Admin.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Admin.exe

Filesize
40KB

MD5
b4fb4e65ddbce2cf0f15276ef6701d9f

SHA1
2c06ee5c147430c8e2528f917a27775490df78fa

SHA256
9a9225d7be3ea57607646a2db58e5fbf18d24aa12d7c0d903dadd0c24477a39e

SHA512
64a92b270ef6ec123b8f5f695c91ba922d04f8964f7e4a1f871b2970c03dd63c3e2d0fd21d9623484d5f1ad03cc3fa90c3ae35334beff766534eed5645b9ce48

Download Submit
C:\Users\Admin\Admin.exe

Filesize
40KB

MD5
b4fb4e65ddbce2cf0f15276ef6701d9f

SHA1
2c06ee5c147430c8e2528f917a27775490df78fa

SHA256
9a9225d7be3ea57607646a2db58e5fbf18d24aa12d7c0d903dadd0c24477a39e

SHA512
64a92b270ef6ec123b8f5f695c91ba922d04f8964f7e4a1f871b2970c03dd63c3e2d0fd21d9623484d5f1ad03cc3fa90c3ae35334beff766534eed5645b9ce48

Download Submit
\Users\Admin\Admin.exe

Filesize
40KB

MD5
b4fb4e65ddbce2cf0f15276ef6701d9f

SHA1
2c06ee5c147430c8e2528f917a27775490df78fa

SHA256
9a9225d7be3ea57607646a2db58e5fbf18d24aa12d7c0d903dadd0c24477a39e

SHA512
64a92b270ef6ec123b8f5f695c91ba922d04f8964f7e4a1f871b2970c03dd63c3e2d0fd21d9623484d5f1ad03cc3fa90c3ae35334beff766534eed5645b9ce48

Download Submit
\Users\Admin\Admin.exe

Filesize
40KB

MD5
b4fb4e65ddbce2cf0f15276ef6701d9f

SHA1
2c06ee5c147430c8e2528f917a27775490df78fa

SHA256
9a9225d7be3ea57607646a2db58e5fbf18d24aa12d7c0d903dadd0c24477a39e

SHA512
64a92b270ef6ec123b8f5f695c91ba922d04f8964f7e4a1f871b2970c03dd63c3e2d0fd21d9623484d5f1ad03cc3fa90c3ae35334beff766534eed5645b9ce48

Download Submit
memory/1976-56-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download