2f819035f40d57ed47842a2437873b201ef3dc2ce90f4efba62ea22f6dd76a0c

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2510019c3b7c8f38d39b839952ead713.exe
Size 330KB
Sample221102-tgr88aaba4
SHA256 2f819035f40d57ed47842a2437873b201ef3dc2ce90f4efba62ea22f6dd76a0c
MD5 2510019c3b7c8f38d39b839952ead713
SHA1 93c0eb59508c1113002c72af560c31b3acc13fb5
SHA512 8192f11512c8c5d35252d55ca98c6f5504226da0ac31083685b9576ad781b806858b15e8384f00c2cc17e7c72d55348a51229d9cd65359416c375fdd75dc32ae
SSDEEP 6144:7weEHEUAW/l3kYbv8bWGm49P9g3NBQKi5W:e4Q8bA49P9SNBcW
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2032	nwkveh.exe
904	nwkveh.exe

Loads dropped DLL 5 IoCs

pid	Process
1380	2510019c3b7c8f38d39b839952ead713.exe
2032	nwkveh.exe
1168	WerFault.exe
1168	WerFault.exe
1168	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvnuh = "C:\\Users\\Admin\\AppData\\Roaming\\uguf\\mcxvwbpaorr.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\nwkveh.exe\""	nwkveh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 904	2032	nwkveh.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	904	WerFault.exe	28

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2032	nwkveh.exe
2032	nwkveh.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2032	1380	2510019c3b7c8f38d39b839952ead713.exe	27
PID 1380 wrote to memory of 2032	1380	2510019c3b7c8f38d39b839952ead713.exe	27
PID 1380 wrote to memory of 2032	1380	2510019c3b7c8f38d39b839952ead713.exe	27
PID 1380 wrote to memory of 2032	1380	2510019c3b7c8f38d39b839952ead713.exe	27
PID 2032 wrote to memory of 904	2032	nwkveh.exe	28
PID 2032 wrote to memory of 904	2032	nwkveh.exe	28
PID 2032 wrote to memory of 904	2032	nwkveh.exe	28
PID 2032 wrote to memory of 904	2032	nwkveh.exe	28
PID 2032 wrote to memory of 904	2032	nwkveh.exe	28
PID 904 wrote to memory of 1168	904	nwkveh.exe	29
PID 904 wrote to memory of 1168	904	nwkveh.exe	29
PID 904 wrote to memory of 1168	904	nwkveh.exe	29
PID 904 wrote to memory of 1168	904	nwkveh.exe	29

C:\Users\Admin\AppData\Local\Temp\2510019c3b7c8f38d39b839952ead713.exe
"C:\Users\Admin\AppData\Local\Temp\2510019c3b7c8f38d39b839952ead713.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
  "C:\Users\Admin\AppData\Local\Temp\nwkveh.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
    "C:\Users\Admin\AppData\Local\Temp\nwkveh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 184
      4⤵
      Loads dropped DLL
      Program crash
      PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gprutb.vx

Path C:\Users\Admin\AppData\Local\Temp\gprutb.vx
Size 98KB
SHA256 3414d5e48672b345e155cd957aec8f876e1e297dc956ec789ba43f9405e384e3
MD5 b27fd23a637e3b1d321c38831b0f1e6f
SHA1 4bd890ec74d2760fcdc68331dab91b6da5adac94
SHA512 86079e96ad2a470e8f6e5633af822d899b92e596ef6399d08a36b9769a379f4fed2e4c1035d5f269853bdae24fcb8ca428058a2323812b47acfa7fc492616487
SSDEEP 1536:WWJpyKc134sOpo3Xt2HJuNTNbMifakUgvsHCmzL4wFGIqxxbCYhSmsVc+TsFFyF3:WEpy1CH0RikUgFzIoxbCYhzH4J7
MD5 SHA1 SHA512 SSDEEP

Submit Download

iopmkjx.d

Path C:\Users\Admin\AppData\Local\Temp\iopmkjx.d
Size 7KB
SHA256 dd7d9b15aa8f85adbe79f5c60c85d6c169c2166a4bbd006ee8bbf449fca83079
MD5 6314f9313bc0ab759562593970003a23
SHA1 69e6b0607400e216ae1eff93945c804a00ec5544
SHA512 4b2982ac0f9d2801ab63f775e6d928d6c0b5c2f856515f4a20594ff1995cdef11c56b5f5455aa71d45b28c092e06d1e7e21f5570778a2e909d8f86daf5dc5b96
SSDEEP 192:QwIpGKXmqhJAbF6PVr97o5gowXm72dRl2Bww+/D3afBvy+jUinDhzE04S:QwexXm2AbulA8maPY7fRVzNkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path \Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path \Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path \Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path \Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path \Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1380-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads