Analysis
-
max time kernel
152s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 14:32
Static task
static1
Behavioral task
behavioral1
Sample
fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
-
Size
354KB
-
MD5
5344175e5547955aed85be21871213d0
-
SHA1
2c560d8197c3972e5e11dad105143cd52b7dfea3
-
SHA256
fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69
-
SHA512
1591d2f41dc7432e2ad598a7e48f579ae3f3a97d269148125b609b8fdd9978b2d0d970546a2afa0331f0c01057f6dcf395e3a3ab3dfa23bb66e50e19cb97c958
-
SSDEEP
3072:0wi51kpjgUdkY8NvaKyGVy1ltYWVnXKiivnFOq43yUQBB3cuAUXXinIcsHtPbXlx:wopjgUqY84ALWVkt3HhybgzvDROyESZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe -
Deletes itself 1 IoCs
pid Process 1244 cmd.exe -
Loads dropped DLL 4 IoCs
pid Process 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 1748 taskmgr.exe 1748 taskmgr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\Server.exe" fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\Server.exe" fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1472 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe Token: SeDebugPrivilege 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe Token: SeDebugPrivilege 1748 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe 1748 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 748 wrote to memory of 1780 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 28 PID 748 wrote to memory of 1780 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 28 PID 748 wrote to memory of 1780 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 28 PID 748 wrote to memory of 1780 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 28 PID 748 wrote to memory of 1244 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 29 PID 748 wrote to memory of 1244 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 29 PID 748 wrote to memory of 1244 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 29 PID 748 wrote to memory of 1244 748 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 29 PID 1780 wrote to memory of 1748 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 30 PID 1780 wrote to memory of 1748 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 30 PID 1780 wrote to memory of 1748 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 30 PID 1780 wrote to memory of 1748 1780 fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe 30 PID 1244 wrote to memory of 1472 1244 cmd.exe 32 PID 1244 wrote to memory of 1472 1244 cmd.exe 32 PID 1244 wrote to memory of 1472 1244 cmd.exe 32 PID 1244 wrote to memory of 1472 1244 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe"C:\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe"C:\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1748
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:1472
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
Filesize354KB
MD55344175e5547955aed85be21871213d0
SHA12c560d8197c3972e5e11dad105143cd52b7dfea3
SHA256fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69
SHA5121591d2f41dc7432e2ad598a7e48f579ae3f3a97d269148125b609b8fdd9978b2d0d970546a2afa0331f0c01057f6dcf395e3a3ab3dfa23bb66e50e19cb97c958
-
C:\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
Filesize354KB
MD55344175e5547955aed85be21871213d0
SHA12c560d8197c3972e5e11dad105143cd52b7dfea3
SHA256fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69
SHA5121591d2f41dc7432e2ad598a7e48f579ae3f3a97d269148125b609b8fdd9978b2d0d970546a2afa0331f0c01057f6dcf395e3a3ab3dfa23bb66e50e19cb97c958
-
\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
Filesize354KB
MD55344175e5547955aed85be21871213d0
SHA12c560d8197c3972e5e11dad105143cd52b7dfea3
SHA256fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69
SHA5121591d2f41dc7432e2ad598a7e48f579ae3f3a97d269148125b609b8fdd9978b2d0d970546a2afa0331f0c01057f6dcf395e3a3ab3dfa23bb66e50e19cb97c958
-
\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
Filesize354KB
MD55344175e5547955aed85be21871213d0
SHA12c560d8197c3972e5e11dad105143cd52b7dfea3
SHA256fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69
SHA5121591d2f41dc7432e2ad598a7e48f579ae3f3a97d269148125b609b8fdd9978b2d0d970546a2afa0331f0c01057f6dcf395e3a3ab3dfa23bb66e50e19cb97c958
-
\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
Filesize354KB
MD55344175e5547955aed85be21871213d0
SHA12c560d8197c3972e5e11dad105143cd52b7dfea3
SHA256fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69
SHA5121591d2f41dc7432e2ad598a7e48f579ae3f3a97d269148125b609b8fdd9978b2d0d970546a2afa0331f0c01057f6dcf395e3a3ab3dfa23bb66e50e19cb97c958
-
\Users\Admin\AppData\Local\Temp\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69\fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69.exe
Filesize354KB
MD55344175e5547955aed85be21871213d0
SHA12c560d8197c3972e5e11dad105143cd52b7dfea3
SHA256fc409acc344d3299f319ddd47afc86310aa931fc799a360d2708f9a93facbd69
SHA5121591d2f41dc7432e2ad598a7e48f579ae3f3a97d269148125b609b8fdd9978b2d0d970546a2afa0331f0c01057f6dcf395e3a3ab3dfa23bb66e50e19cb97c958