Overview

overview

10

Static

static

f22c89dabf...41.exe

windows7-x64

10

f22c89dabf...41.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f22c89dabf42bc4c63431fa203230971de5c10add8438b5ce0598f4d87c2f041.exe

  • Size

    1.5MB

  • MD5

    9075907834bd3f9ce33f40911fc5c838

  • SHA1

    57be8c83a253b611b44cf90a06f9d689540b7d65

  • SHA256

    f22c89dabf42bc4c63431fa203230971de5c10add8438b5ce0598f4d87c2f041

  • SHA512

    48e87d6dcafa325413b8b3f583554b984527ab154abe2993ee158a940a3cf435aaf3387b2fdbca4f555b3a72ed2403686045c3c62220ec719ec13681f1cd285e

  • SSDEEP

    24576:xGr/Cm+X18zVkUetVI5ut/VkP+x6IS0NDlWtN:QE1yZuvS0NZWf

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 48 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 47 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f22c89dabf42bc4c63431fa203230971de5c10add8438b5ce0598f4d87c2f041.exe
    "C:\Users\Admin\AppData\Local\Temp\f22c89dabf42bc4c63431fa203230971de5c10add8438b5ce0598f4d87c2f041.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
      C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:1044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 408
      2⤵
      • Program crash
      PID:572

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
    Filesize

    154KB

    MD5

    4fd22142f54692463a7b98b7de175573

    SHA1

    21d079909eeffda4b79dace30eafa0860bbd4c62

    SHA256

    882e52f06fc8169280156b9774796a16a30abd38efe6ea0638db4f8b52a39f06

    SHA512

    e9cd9fad3390895c04fa5b69024afc72fab564294abc26182821b3f1fa567165d4d1feb4e105becb46bbe6c6055a0de1c2ef523b9a17fa4ba028995e2d00d52f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\inf4D2.tmp
    Filesize

    154KB

    MD5

    4fd22142f54692463a7b98b7de175573

    SHA1

    21d079909eeffda4b79dace30eafa0860bbd4c62

    SHA256

    882e52f06fc8169280156b9774796a16a30abd38efe6ea0638db4f8b52a39f06

    SHA512

    e9cd9fad3390895c04fa5b69024afc72fab564294abc26182821b3f1fa567165d4d1feb4e105becb46bbe6c6055a0de1c2ef523b9a17fa4ba028995e2d00d52f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\inf4D2.tmp
    Filesize

    154KB

    MD5

    4fd22142f54692463a7b98b7de175573

    SHA1

    21d079909eeffda4b79dace30eafa0860bbd4c62

    SHA256

    882e52f06fc8169280156b9774796a16a30abd38efe6ea0638db4f8b52a39f06

    SHA512

    e9cd9fad3390895c04fa5b69024afc72fab564294abc26182821b3f1fa567165d4d1feb4e105becb46bbe6c6055a0de1c2ef523b9a17fa4ba028995e2d00d52f

    Download Submit

  • memory/1980-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

    Filesize

    8KB

    Download