4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
Size

31KB
MD5

0cd7d4b890893d0b1b43f9372c9679d0
SHA1

98ef16fc4599f6866797041f8b72fdd700321942
SHA256

4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35
SHA512

eb2ef8dcba3a6902acd789484545f9bd479c211b6b3fcf94fd0e7c910d34b112197ebdd6069295e2420a99389371891d2f8335ef8692f5fec4ca55534b3c1608
SSDEEP

768:0gce/Rjlf92wjfGrHci9R3T4q7SH/Ep/OFvTUhHRp3hYypy1:wOXf9T6Dh/3WhWDU1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

880 cmd.exe

pid	process
880	cmd.exe

Drops file in System32 directory 5 IoCs

Processes:

4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sxload.tmp	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
File created	C:\Windows\System32\123476E.tmp	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
File opened for modification	C:\Windows\SysWOW64\123476E.tmp	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
File created	C:\Windows\System32\12357F3.tmp	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
File opened for modification	C:\Windows\SysWOW64\12357F3.tmp	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe

Drops file in Program Files directory 1 IoCs

Processes:

4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe

description ioc process

File created C:\Program Files (x86)\Common Files\sxwd.tmp 4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1656 taskkill.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\sxwd.tmp	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe

pid	process
1656	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
Token: SeDebugPrivilege	1656	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe

pid	process
2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe

description	pid	process	target process
PID 2044 wrote to memory of 1656	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe	taskkill.exe
PID 2044 wrote to memory of 1656	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe	taskkill.exe
PID 2044 wrote to memory of 1656	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe	taskkill.exe
PID 2044 wrote to memory of 1656	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe	taskkill.exe
PID 2044 wrote to memory of 880	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe	cmd.exe
PID 2044 wrote to memory of 880	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe	cmd.exe
PID 2044 wrote to memory of 880	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe	cmd.exe
PID 2044 wrote to memory of 880	2044	4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe
"C:\Users\Admin\AppData\Local\Temp\4005d53dddf693ac3c7479de87b44590bcac6bacef09736dcdc0a68c318dcb35.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "asktao.mod"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\SysWOW64\cmd.exe
cmd /c 1.bat
2⤵
- Deletes itself
PID:880

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat
Filesize
251B

MD5
5e287848926f2e1beb153ec6cf88a686

SHA1
e90163c5474c5156388aa3fd7a4f49abbc7e9955

SHA256
429da30ca828e355bfa87e22d34a76eb1cb7b275d251b577953dfd31abb00064

SHA512
a88d21611149992650426b0ba3aa1f86f6f113b0f691ac7f979f85548f479a37fbd54575f2a1ca77c24c2aafee9688f9b924c2e488685970ec9fea4a1edf026c

Download Submit
memory/880-57-0x0000000000000000-mapping.dmp

Download
memory/1656-56-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads