Analysis
-
max time kernel
36s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe
Resource
win10v2004-20220812-en
General
-
Target
76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe
-
Size
593KB
-
MD5
20e713829915353a68cace4f809ebc28
-
SHA1
c88c4b0bed04eb4569c3ffbe3de58265bc244bc6
-
SHA256
76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f
-
SHA512
dd4323f15f06305e6ed289811d5ae634ccd170c717a985a3e4d4dc82b5a4e1ddd67bfbc839c2d3126a532f57965402807cc754dccbc5591affb72b43137b3658
-
SSDEEP
12288:VuBSP/amClBJSpc/aaT9/gur79Yq63kfydqAKTE1qH:sA6lBwy/aI/gK79YH0FAgxH
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 3020 BqjnC0gFVHRul8.exe 4840 win.exe 4092 wio.exe 5076 wiq.exe -
resource yara_rule behavioral2/memory/1076-158-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1076-156-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1076-152-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1076-164-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 4824 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sbaketozunes = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\AMVauipr.dll\",Startup" rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 win.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5076 set thread context of 1076 5076 wiq.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 3020 BqjnC0gFVHRul8.exe 3020 BqjnC0gFVHRul8.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 3020 BqjnC0gFVHRul8.exe 3020 BqjnC0gFVHRul8.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 4840 win.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3020 BqjnC0gFVHRul8.exe 5076 wiq.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 428 wrote to memory of 3020 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 81 PID 428 wrote to memory of 3020 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 81 PID 428 wrote to memory of 3020 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 81 PID 428 wrote to memory of 4840 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 82 PID 428 wrote to memory of 4840 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 82 PID 428 wrote to memory of 4840 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 82 PID 428 wrote to memory of 4092 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 83 PID 428 wrote to memory of 4092 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 83 PID 428 wrote to memory of 4092 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 83 PID 428 wrote to memory of 5076 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 84 PID 428 wrote to memory of 5076 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 84 PID 428 wrote to memory of 5076 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 84 PID 428 wrote to memory of 5056 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 85 PID 428 wrote to memory of 5056 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 85 PID 428 wrote to memory of 5056 428 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe 85 PID 5076 wrote to memory of 1076 5076 wiq.exe 87 PID 5076 wrote to memory of 1076 5076 wiq.exe 87 PID 5076 wrote to memory of 1076 5076 wiq.exe 87 PID 5076 wrote to memory of 1076 5076 wiq.exe 87 PID 5076 wrote to memory of 1076 5076 wiq.exe 87 PID 5076 wrote to memory of 1076 5076 wiq.exe 87 PID 5076 wrote to memory of 1076 5076 wiq.exe 87 PID 5076 wrote to memory of 1076 5076 wiq.exe 87 PID 4092 wrote to memory of 4824 4092 wio.exe 88 PID 4092 wrote to memory of 4824 4092 wio.exe 88 PID 4092 wrote to memory of 4824 4092 wio.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe"C:\Users\Admin\AppData\Local\Temp\76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\BqjnC0gFVHRul8.exeBqjnC0gFVHRul8.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
C:\Users\Admin\win.exewin.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Users\Admin\wio.exewio.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\AMVauipr.dll",Startup3⤵
- Loads dropped DLL
- Adds Run key to start application
PID:4824
-
-
-
C:\Users\Admin\wiq.exewiq.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe2⤵PID:5056
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD519f8a2d4e8270baf8bd5a6086f565e70
SHA1b5a05abe09066906b569f0fadefb00fb567ef547
SHA2562f677a22315a327d82514449be56d53cd85a8dd3eef75317231647faac6caf50
SHA5128a5686b22a993f8c38420f9c163e6321eab7a089858da4852160684ccc260d82f21e933365e0f413418849f9af26786d805d0dd6295546b52ae9ab5fcf88ed63
-
Filesize
103KB
MD519f8a2d4e8270baf8bd5a6086f565e70
SHA1b5a05abe09066906b569f0fadefb00fb567ef547
SHA2562f677a22315a327d82514449be56d53cd85a8dd3eef75317231647faac6caf50
SHA5128a5686b22a993f8c38420f9c163e6321eab7a089858da4852160684ccc260d82f21e933365e0f413418849f9af26786d805d0dd6295546b52ae9ab5fcf88ed63
-
Filesize
148KB
MD5fc8e30e732d9e1483b7d29ea39ad9c15
SHA104215f820a214d11e1dd9a832ac264605cf98604
SHA256c3bb55f793445fe9ca4dbdd55c7dd1d5ec90c807d3270833b3f9678a9a956585
SHA512d56cb22fde3d54cc4d5008857e573e4b8182b4d690c9a9ca9978aca5ed0051001c919588918ac17dd7c3d41c90acca9411d42cf33c10accd12d3d313fb60afd6
-
Filesize
148KB
MD5fc8e30e732d9e1483b7d29ea39ad9c15
SHA104215f820a214d11e1dd9a832ac264605cf98604
SHA256c3bb55f793445fe9ca4dbdd55c7dd1d5ec90c807d3270833b3f9678a9a956585
SHA512d56cb22fde3d54cc4d5008857e573e4b8182b4d690c9a9ca9978aca5ed0051001c919588918ac17dd7c3d41c90acca9411d42cf33c10accd12d3d313fb60afd6
-
Filesize
172KB
MD516dfe37b77854e727eabedd05239ebee
SHA19218bb944834fb46eb2f04858ada0dacdf821d77
SHA2568ee33551b06628414ed9003fd0c35ab5abbedf6f85e50c9bfdb99fc72172d267
SHA51256c765b030817f0903dd9ce50aefb3511e30706891f7d9accd7f95c465d1890fdda3ab59238919b59951fe1c361699f80675b6fab9c9df26dd4f22d97b0ca903
-
Filesize
172KB
MD516dfe37b77854e727eabedd05239ebee
SHA19218bb944834fb46eb2f04858ada0dacdf821d77
SHA2568ee33551b06628414ed9003fd0c35ab5abbedf6f85e50c9bfdb99fc72172d267
SHA51256c765b030817f0903dd9ce50aefb3511e30706891f7d9accd7f95c465d1890fdda3ab59238919b59951fe1c361699f80675b6fab9c9df26dd4f22d97b0ca903
-
Filesize
103KB
MD5f7756f6980dc23ef661085d6cd999831
SHA1cd77f7a9bc8c058023779a531e2deac8c3241638
SHA25653122fb8bd9b1a304af221e3172c1770f18d20e71f275b98bcfe10cc81ec3740
SHA512b1e51945dea731c962140b9755c2d6b549feb3fb0d9793a0c67fe6a99498dde1a4744931ca80053f723eec221975e26220e7c357188bd0f11f5966bf2cc618df
-
Filesize
103KB
MD5f7756f6980dc23ef661085d6cd999831
SHA1cd77f7a9bc8c058023779a531e2deac8c3241638
SHA25653122fb8bd9b1a304af221e3172c1770f18d20e71f275b98bcfe10cc81ec3740
SHA512b1e51945dea731c962140b9755c2d6b549feb3fb0d9793a0c67fe6a99498dde1a4744931ca80053f723eec221975e26220e7c357188bd0f11f5966bf2cc618df
-
Filesize
52KB
MD565a849404ffe62e0d2f56d7993f00920
SHA16401a9e92690172958fbf0ee122990479628e92f
SHA256afe7c75a0e8d28d5f068cf3605f9aa10016d37348eab013b6dc487e943110c50
SHA51299af61b924d550ff3d8c52db86991cc40ebd94510982dc69ce99bb975ad8de32c07ea9c7eb28d05e55117b15ab3b57d3d2bfe25c744c8918d63d96ef974d5d38
-
Filesize
52KB
MD565a849404ffe62e0d2f56d7993f00920
SHA16401a9e92690172958fbf0ee122990479628e92f
SHA256afe7c75a0e8d28d5f068cf3605f9aa10016d37348eab013b6dc487e943110c50
SHA51299af61b924d550ff3d8c52db86991cc40ebd94510982dc69ce99bb975ad8de32c07ea9c7eb28d05e55117b15ab3b57d3d2bfe25c744c8918d63d96ef974d5d38