Analysis

  • max time kernel
    36s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 14:29

General

  • Target

    76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe

  • Size

    593KB

  • MD5

    20e713829915353a68cace4f809ebc28

  • SHA1

    c88c4b0bed04eb4569c3ffbe3de58265bc244bc6

  • SHA256

    76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f

  • SHA512

    dd4323f15f06305e6ed289811d5ae634ccd170c717a985a3e4d4dc82b5a4e1ddd67bfbc839c2d3126a532f57965402807cc754dccbc5591affb72b43137b3658

  • SSDEEP

    12288:VuBSP/amClBJSpc/aaT9/gur79Yq63kfydqAKTE1qH:sA6lBwy/aI/gK79YH0FAgxH

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe
    "C:\Users\Admin\AppData\Local\Temp\76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\Users\Admin\BqjnC0gFVHRul8.exe
      BqjnC0gFVHRul8.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3020
    • C:\Users\Admin\win.exe
      win.exe
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of AdjustPrivilegeToken
      PID:4840
    • C:\Users\Admin\wio.exe
      wio.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\AMVauipr.dll",Startup
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        PID:4824
    • C:\Users\Admin\wiq.exe
      wiq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\system32\svchost.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1076
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del 76aef93c5c75afb30a9bb2db332c7929b4455385068896c9bdadc28f2f287f5f.exe
      2⤵
        PID:5056

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\AMVauipr.dll

            Filesize

            103KB

            MD5

            19f8a2d4e8270baf8bd5a6086f565e70

            SHA1

            b5a05abe09066906b569f0fadefb00fb567ef547

            SHA256

            2f677a22315a327d82514449be56d53cd85a8dd3eef75317231647faac6caf50

            SHA512

            8a5686b22a993f8c38420f9c163e6321eab7a089858da4852160684ccc260d82f21e933365e0f413418849f9af26786d805d0dd6295546b52ae9ab5fcf88ed63

          • C:\Users\Admin\AppData\Local\AMVauipr.dll

            Filesize

            103KB

            MD5

            19f8a2d4e8270baf8bd5a6086f565e70

            SHA1

            b5a05abe09066906b569f0fadefb00fb567ef547

            SHA256

            2f677a22315a327d82514449be56d53cd85a8dd3eef75317231647faac6caf50

            SHA512

            8a5686b22a993f8c38420f9c163e6321eab7a089858da4852160684ccc260d82f21e933365e0f413418849f9af26786d805d0dd6295546b52ae9ab5fcf88ed63

          • C:\Users\Admin\BqjnC0gFVHRul8.exe

            Filesize

            148KB

            MD5

            fc8e30e732d9e1483b7d29ea39ad9c15

            SHA1

            04215f820a214d11e1dd9a832ac264605cf98604

            SHA256

            c3bb55f793445fe9ca4dbdd55c7dd1d5ec90c807d3270833b3f9678a9a956585

            SHA512

            d56cb22fde3d54cc4d5008857e573e4b8182b4d690c9a9ca9978aca5ed0051001c919588918ac17dd7c3d41c90acca9411d42cf33c10accd12d3d313fb60afd6

          • C:\Users\Admin\BqjnC0gFVHRul8.exe

            Filesize

            148KB

            MD5

            fc8e30e732d9e1483b7d29ea39ad9c15

            SHA1

            04215f820a214d11e1dd9a832ac264605cf98604

            SHA256

            c3bb55f793445fe9ca4dbdd55c7dd1d5ec90c807d3270833b3f9678a9a956585

            SHA512

            d56cb22fde3d54cc4d5008857e573e4b8182b4d690c9a9ca9978aca5ed0051001c919588918ac17dd7c3d41c90acca9411d42cf33c10accd12d3d313fb60afd6

          • C:\Users\Admin\win.exe

            Filesize

            172KB

            MD5

            16dfe37b77854e727eabedd05239ebee

            SHA1

            9218bb944834fb46eb2f04858ada0dacdf821d77

            SHA256

            8ee33551b06628414ed9003fd0c35ab5abbedf6f85e50c9bfdb99fc72172d267

            SHA512

            56c765b030817f0903dd9ce50aefb3511e30706891f7d9accd7f95c465d1890fdda3ab59238919b59951fe1c361699f80675b6fab9c9df26dd4f22d97b0ca903

          • C:\Users\Admin\win.exe

            Filesize

            172KB

            MD5

            16dfe37b77854e727eabedd05239ebee

            SHA1

            9218bb944834fb46eb2f04858ada0dacdf821d77

            SHA256

            8ee33551b06628414ed9003fd0c35ab5abbedf6f85e50c9bfdb99fc72172d267

            SHA512

            56c765b030817f0903dd9ce50aefb3511e30706891f7d9accd7f95c465d1890fdda3ab59238919b59951fe1c361699f80675b6fab9c9df26dd4f22d97b0ca903

          • C:\Users\Admin\wio.exe

            Filesize

            103KB

            MD5

            f7756f6980dc23ef661085d6cd999831

            SHA1

            cd77f7a9bc8c058023779a531e2deac8c3241638

            SHA256

            53122fb8bd9b1a304af221e3172c1770f18d20e71f275b98bcfe10cc81ec3740

            SHA512

            b1e51945dea731c962140b9755c2d6b549feb3fb0d9793a0c67fe6a99498dde1a4744931ca80053f723eec221975e26220e7c357188bd0f11f5966bf2cc618df

          • C:\Users\Admin\wio.exe

            Filesize

            103KB

            MD5

            f7756f6980dc23ef661085d6cd999831

            SHA1

            cd77f7a9bc8c058023779a531e2deac8c3241638

            SHA256

            53122fb8bd9b1a304af221e3172c1770f18d20e71f275b98bcfe10cc81ec3740

            SHA512

            b1e51945dea731c962140b9755c2d6b549feb3fb0d9793a0c67fe6a99498dde1a4744931ca80053f723eec221975e26220e7c357188bd0f11f5966bf2cc618df

          • C:\Users\Admin\wiq.exe

            Filesize

            52KB

            MD5

            65a849404ffe62e0d2f56d7993f00920

            SHA1

            6401a9e92690172958fbf0ee122990479628e92f

            SHA256

            afe7c75a0e8d28d5f068cf3605f9aa10016d37348eab013b6dc487e943110c50

            SHA512

            99af61b924d550ff3d8c52db86991cc40ebd94510982dc69ce99bb975ad8de32c07ea9c7eb28d05e55117b15ab3b57d3d2bfe25c744c8918d63d96ef974d5d38

          • C:\Users\Admin\wiq.exe

            Filesize

            52KB

            MD5

            65a849404ffe62e0d2f56d7993f00920

            SHA1

            6401a9e92690172958fbf0ee122990479628e92f

            SHA256

            afe7c75a0e8d28d5f068cf3605f9aa10016d37348eab013b6dc487e943110c50

            SHA512

            99af61b924d550ff3d8c52db86991cc40ebd94510982dc69ce99bb975ad8de32c07ea9c7eb28d05e55117b15ab3b57d3d2bfe25c744c8918d63d96ef974d5d38

          • memory/1076-152-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/1076-158-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/1076-156-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/1076-164-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/4092-147-0x0000000010000000-0x000000001001D000-memory.dmp

            Filesize

            116KB

          • memory/4092-155-0x0000000000601000-0x000000000060F000-memory.dmp

            Filesize

            56KB

          • memory/4824-163-0x0000000002941000-0x000000000294F000-memory.dmp

            Filesize

            56KB

          • memory/4824-162-0x0000000010000000-0x000000001001D000-memory.dmp

            Filesize

            116KB

          • memory/4840-150-0x00000000005F0000-0x0000000000646000-memory.dmp

            Filesize

            344KB

          • memory/4840-157-0x00000000005F0000-0x0000000000646000-memory.dmp

            Filesize

            344KB

          • memory/4840-153-0x0000000000400000-0x0000000000456000-memory.dmp

            Filesize

            344KB

          • memory/4840-165-0x0000000000400000-0x0000000000456000-memory.dmp

            Filesize

            344KB