a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25

General

Target

a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe
Size

92KB
MD5

829c571d4e493decde84cae4da3b3d00
SHA1

3d4672501d68ed72493b553820cc64674a9fb398
SHA256

a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25
SHA512

67dc58bd1740808b4c6b60a55e5088c89b12265602b877e277896b4d019ac381aae29c4a850ccc32d7e62dd1695038478bcd7eb1a11395658419b1a025655cd6
SSDEEP

1536:vztXrx6mqhy3gnjTH9ZYmOEI9TwjXTQbFaxXni51pY:Nx6mqhy3gnjTH9ZYmOx9TwHQbFaxsW

Score

8^/10

persistence upx vmprotect

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1020-55-0x0000000000400000-0x0000000000419000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000a00000001311a-61.dat	vmprotect
behavioral1/files/0x000a00000001311a-62.dat	vmprotect

Deletes itself 1 IoCs

pid	Process
808	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1876	rundll32.exe
1876	rundll32.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sfcos.dll	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe
File opened for modification	C:\Windows\SysWOW64\sfcos.dll	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe
File created	C:\Windows\SysWOW64\systemp	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1876	rundll32.exe
1876	rundll32.exe
1876	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1708	1020	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe	27
PID 1020 wrote to memory of 1708	1020	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe	27
PID 1020 wrote to memory of 1708	1020	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe	27
PID 1020 wrote to memory of 1708	1020	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe	27
PID 1020 wrote to memory of 808	1020	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe	29
PID 1020 wrote to memory of 808	1020	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe	29
PID 1020 wrote to memory of 808	1020	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe	29
PID 1020 wrote to memory of 808	1020	a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe	29
PID 808 wrote to memory of 1876	808	cmd.exe	31
PID 808 wrote to memory of 1876	808	cmd.exe	31
PID 808 wrote to memory of 1876	808	cmd.exe	31
PID 808 wrote to memory of 1876	808	cmd.exe	31
PID 808 wrote to memory of 1876	808	cmd.exe	31
PID 808 wrote to memory of 1876	808	cmd.exe	31
PID 808 wrote to memory of 1876	808	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe
"C:\Users\Admin\AppData\Local\Temp\a7b3852ce66047a12c1d9fbde162623989370d7691b65b1bf707ab6208cafb25.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\sfc.exe
  "C:\Windows\system32\sfc.exe" /REVERT
  2⤵
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\del.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Windows\system32\s6am.ime,Runed
    3⤵
    - Loads dropped DLL
    - Modifies WinLogon
    - Suspicious behavior: EnumeratesProcesses
    PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\s6am.ime

Filesize
53KB

MD5
f587a43aea89ea4f0302a090c507d46e

SHA1
5deffc6a57ce9692fd8e79014e343be8486abf46

SHA256
8feefb98d51674e327c03455134e6f6732355de057fd9074e05eb2c111637dd9

SHA512
8182372ce39620c4f673ce5f977ca80e5a87a0da526d8918093aabcb2f1a38d55542f9a49566f263338a5e2ef87d3e35ccebf07246056b543a76f6bc7175797a

Download Submit
C:\Windows\SysWOW64\sfcos.dll

Filesize
40KB

MD5
84799328d87b3091a3bdd251e1ad31f9

SHA1
64dbbe8210049f4d762de22525a7fe4313bf99d0

SHA256
f85521215924388830dbb13580688db70b46af4c7d82d549d09086438f8d237b

SHA512
0a9401c9c687f0edca01258c7920596408934caa21e5392dbaefc222c5c021255a40ec7c114a805cdb7f5a6153ec9fa9592edcc9e45406ce5612aa4e3da6a2c4

Download Submit
C:\Windows\SysWOW64\systemp

Filesize
4KB

MD5
c508ac8d5cd9412c5facc89c75f72f84

SHA1
be568e613fcd4382d9e55a7ad52e59c904d28b19

SHA256
9a41324466cad79fa321896b1f7b7e6eee500535d3e30ca8a86e07f8b261e5a9

SHA512
a8422381db900e3a78f751333da637a3ff2c34081672c1fca74da6aadd56fd5d0aa000500ea0d277be36235c8dfbf9fc9d9600394b6ee583e4b36315968ffb83

Download Submit
\??\c:\del.bat

Filesize
195B

MD5
02b0af2f17d4cd91fb690c8d6afe6f91

SHA1
3022451f70fc5a21094fc763bc5092ba2fafe1d7

SHA256
1591a4c6a0e8d9d428822157d73d25cd9ecb92b3d93a3fcf2b434fcfc2378448

SHA512
4762c4e449871e9038ea7e39ab82fceab8b559bd8d14c0c4c5f6567bba6d58196d82efd7fdcff9e2aa0f452ed1859120e3593a21ec8c11771038a57fae452156

Download Submit
\Windows\SysWOW64\s6am.ime

Filesize
53KB

MD5
f587a43aea89ea4f0302a090c507d46e

SHA1
5deffc6a57ce9692fd8e79014e343be8486abf46

SHA256
8feefb98d51674e327c03455134e6f6732355de057fd9074e05eb2c111637dd9

SHA512
8182372ce39620c4f673ce5f977ca80e5a87a0da526d8918093aabcb2f1a38d55542f9a49566f263338a5e2ef87d3e35ccebf07246056b543a76f6bc7175797a

Download Submit
\Windows\SysWOW64\sfcos.dll

Filesize
40KB

MD5
84799328d87b3091a3bdd251e1ad31f9

SHA1
64dbbe8210049f4d762de22525a7fe4313bf99d0

SHA256
f85521215924388830dbb13580688db70b46af4c7d82d549d09086438f8d237b

SHA512
0a9401c9c687f0edca01258c7920596408934caa21e5392dbaefc222c5c021255a40ec7c114a805cdb7f5a6153ec9fa9592edcc9e45406ce5612aa4e3da6a2c4

Download Submit
memory/1020-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1020-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing