Analysis
-
max time kernel
169s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 15:00
Static task
static1
Behavioral task
behavioral1
Sample
163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe
Resource
win10v2004-20220812-en
General
-
Target
163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe
-
Size
201KB
-
MD5
091b245a94e211c06342a7039acbc643
-
SHA1
5c3d1bc830767d47aaf579fb72367933f799e9a9
-
SHA256
163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453
-
SHA512
d00301d958275ce1c97e82b7f1819ddef27a47059abd8823958ef988363af45d745055738c8a9e8272ae7c4392cf0d90dd09b3c68e6ae602521bb0458c9fd218
-
SSDEEP
6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFM:HqEjk7l7FM
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1236 security.exe 1188 security.exe -
resource yara_rule behavioral1/memory/1568-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1568-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1568-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1568-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1568-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1568-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1568-108-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1188-110-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1188-112-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 5 IoCs
pid Process 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\security.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1116 set thread context of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1236 set thread context of 1188 1236 security.exe 33 PID 1236 set thread context of 812 1236 security.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe Token: SeDebugPrivilege 1188 security.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 1236 security.exe 1188 security.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1116 wrote to memory of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1116 wrote to memory of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1116 wrote to memory of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1116 wrote to memory of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1116 wrote to memory of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1116 wrote to memory of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1116 wrote to memory of 1568 1116 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 28 PID 1568 wrote to memory of 908 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 29 PID 1568 wrote to memory of 908 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 29 PID 1568 wrote to memory of 908 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 29 PID 1568 wrote to memory of 908 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 29 PID 908 wrote to memory of 1676 908 cmd.exe 31 PID 908 wrote to memory of 1676 908 cmd.exe 31 PID 908 wrote to memory of 1676 908 cmd.exe 31 PID 908 wrote to memory of 1676 908 cmd.exe 31 PID 1568 wrote to memory of 1236 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 32 PID 1568 wrote to memory of 1236 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 32 PID 1568 wrote to memory of 1236 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 32 PID 1568 wrote to memory of 1236 1568 163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe 32 PID 1236 wrote to memory of 1188 1236 security.exe 33 PID 1236 wrote to memory of 1188 1236 security.exe 33 PID 1236 wrote to memory of 1188 1236 security.exe 33 PID 1236 wrote to memory of 1188 1236 security.exe 33 PID 1236 wrote to memory of 1188 1236 security.exe 33 PID 1236 wrote to memory of 1188 1236 security.exe 33 PID 1236 wrote to memory of 1188 1236 security.exe 33 PID 1236 wrote to memory of 1188 1236 security.exe 33 PID 1236 wrote to memory of 812 1236 security.exe 34 PID 1236 wrote to memory of 812 1236 security.exe 34 PID 1236 wrote to memory of 812 1236 security.exe 34 PID 1236 wrote to memory of 812 1236 security.exe 34 PID 1236 wrote to memory of 812 1236 security.exe 34 PID 1236 wrote to memory of 812 1236 security.exe 34 PID 1236 wrote to memory of 812 1236 security.exe 34 PID 1236 wrote to memory of 812 1236 security.exe 34 PID 1236 wrote to memory of 812 1236 security.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe"C:\Users\Admin\AppData\Local\Temp\163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe"C:\Users\Admin\AppData\Local\Temp\163332c8094ff17201bf90f233c65a4733c4475e2489c74f31b9b10513921453.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\OBNVM.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f4⤵
- Adds Run key to start application
PID:1676
-
-
-
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵PID:812
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD56f473a1ba53e043362047f72e20b34f4
SHA1e8f121a589e1207ed950453376ee1d21b1223835
SHA2565fbce2c77a90ba9edbcf60be3851ab81633b7c10b1babb624d475c7be589de4b
SHA512b4976d40bc708ae6cddf367a5382cd532e4cf235b848cdaa4e4d317e06d9126e50745a7772591bc21dc7380689f4399e57501b0aa73cd231bce32e22d53b0818
-
Filesize
201KB
MD56ef4e75af0a2a448e4b3f04df5c205f9
SHA18881381e43d9b47cfdbbb2d94cc695984e163db2
SHA25685e7f4fe708eb419457dbc11fa352758218e9f6d7c734d094f0fcbcf68451caf
SHA5125412d67f6381f737280afe2a18790d3f83c5d8f85372ccee02717b2e930163666aae3c8e6a3c2a1b0f67394f15496f43a10c6c053a6c6e82591d6ff391ef14ac
-
Filesize
201KB
MD56ef4e75af0a2a448e4b3f04df5c205f9
SHA18881381e43d9b47cfdbbb2d94cc695984e163db2
SHA25685e7f4fe708eb419457dbc11fa352758218e9f6d7c734d094f0fcbcf68451caf
SHA5125412d67f6381f737280afe2a18790d3f83c5d8f85372ccee02717b2e930163666aae3c8e6a3c2a1b0f67394f15496f43a10c6c053a6c6e82591d6ff391ef14ac
-
Filesize
201KB
MD56ef4e75af0a2a448e4b3f04df5c205f9
SHA18881381e43d9b47cfdbbb2d94cc695984e163db2
SHA25685e7f4fe708eb419457dbc11fa352758218e9f6d7c734d094f0fcbcf68451caf
SHA5125412d67f6381f737280afe2a18790d3f83c5d8f85372ccee02717b2e930163666aae3c8e6a3c2a1b0f67394f15496f43a10c6c053a6c6e82591d6ff391ef14ac
-
Filesize
201KB
MD56ef4e75af0a2a448e4b3f04df5c205f9
SHA18881381e43d9b47cfdbbb2d94cc695984e163db2
SHA25685e7f4fe708eb419457dbc11fa352758218e9f6d7c734d094f0fcbcf68451caf
SHA5125412d67f6381f737280afe2a18790d3f83c5d8f85372ccee02717b2e930163666aae3c8e6a3c2a1b0f67394f15496f43a10c6c053a6c6e82591d6ff391ef14ac
-
Filesize
201KB
MD56ef4e75af0a2a448e4b3f04df5c205f9
SHA18881381e43d9b47cfdbbb2d94cc695984e163db2
SHA25685e7f4fe708eb419457dbc11fa352758218e9f6d7c734d094f0fcbcf68451caf
SHA5125412d67f6381f737280afe2a18790d3f83c5d8f85372ccee02717b2e930163666aae3c8e6a3c2a1b0f67394f15496f43a10c6c053a6c6e82591d6ff391ef14ac
-
Filesize
201KB
MD56ef4e75af0a2a448e4b3f04df5c205f9
SHA18881381e43d9b47cfdbbb2d94cc695984e163db2
SHA25685e7f4fe708eb419457dbc11fa352758218e9f6d7c734d094f0fcbcf68451caf
SHA5125412d67f6381f737280afe2a18790d3f83c5d8f85372ccee02717b2e930163666aae3c8e6a3c2a1b0f67394f15496f43a10c6c053a6c6e82591d6ff391ef14ac
-
Filesize
201KB
MD56ef4e75af0a2a448e4b3f04df5c205f9
SHA18881381e43d9b47cfdbbb2d94cc695984e163db2
SHA25685e7f4fe708eb419457dbc11fa352758218e9f6d7c734d094f0fcbcf68451caf
SHA5125412d67f6381f737280afe2a18790d3f83c5d8f85372ccee02717b2e930163666aae3c8e6a3c2a1b0f67394f15496f43a10c6c053a6c6e82591d6ff391ef14ac
-
Filesize
201KB
MD56ef4e75af0a2a448e4b3f04df5c205f9
SHA18881381e43d9b47cfdbbb2d94cc695984e163db2
SHA25685e7f4fe708eb419457dbc11fa352758218e9f6d7c734d094f0fcbcf68451caf
SHA5125412d67f6381f737280afe2a18790d3f83c5d8f85372ccee02717b2e930163666aae3c8e6a3c2a1b0f67394f15496f43a10c6c053a6c6e82591d6ff391ef14ac