Analysis
-
max time kernel
9s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-11-2022 03:00
Static task
static1
Behavioral task
behavioral1
Sample
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe
Resource
win7-20220812-en
General
-
Target
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe
-
Size
24KB
-
MD5
046fb6d83046827da18086aa6ac523aa
-
SHA1
945ceb168b4b5f207aa9e516584c32de29bb650c
-
SHA256
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a
-
SHA512
3c9477c45f95b7815729d7e7ced5427e176d929d8f31f163de5b502e9189ddd5d07a88d6b3b9323a99898672587ba7b071dd8f3691690191f7a4907f26b170b3
-
SSDEEP
192:8FES6pYk/gvPNJv+mv+kAUoynYlLvJpNNwD1iT9fF73At4EaQ9r:8v73NvViTkaQl
Malware Config
Signatures
-
Processes:
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
k4.exek4.exek4.exek4.exepid process 2028 k4.exe 2036 k4.exe 2028 k4.exe 2036 k4.exe -
Loads dropped DLL 4 IoCs
Processes:
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exepid process 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe -
Processes:
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 852 taskkill.exe 852 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
k4.exetaskkill.exek4.exetaskkill.exedescription pid process Token: SeLoadDriverPrivilege 2036 k4.exe Token: SeDebugPrivilege 852 taskkill.exe Token: SeLoadDriverPrivilege 2036 k4.exe Token: SeDebugPrivilege 852 taskkill.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exepid process 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.execmd.exe2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.execmd.exedescription pid process target process PID 1084 wrote to memory of 2028 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2028 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2028 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2028 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2036 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2036 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2036 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2036 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 1756 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe cmd.exe PID 1084 wrote to memory of 1756 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe cmd.exe PID 1084 wrote to memory of 1756 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe cmd.exe PID 1084 wrote to memory of 1756 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe cmd.exe PID 1756 wrote to memory of 852 1756 cmd.exe taskkill.exe PID 1756 wrote to memory of 852 1756 cmd.exe taskkill.exe PID 1756 wrote to memory of 852 1756 cmd.exe taskkill.exe PID 1756 wrote to memory of 852 1756 cmd.exe taskkill.exe PID 1084 wrote to memory of 2028 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2028 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2028 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2028 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2036 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2036 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2036 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 2036 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe k4.exe PID 1084 wrote to memory of 1756 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe cmd.exe PID 1084 wrote to memory of 1756 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe cmd.exe PID 1084 wrote to memory of 1756 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe cmd.exe PID 1084 wrote to memory of 1756 1084 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe cmd.exe PID 1756 wrote to memory of 852 1756 cmd.exe taskkill.exe PID 1756 wrote to memory of 852 1756 cmd.exe taskkill.exe PID 1756 wrote to memory of 852 1756 cmd.exe taskkill.exe PID 1756 wrote to memory of 852 1756 cmd.exe taskkill.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe"C:\Users\Admin\AppData\Local\Temp\2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im k4.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe"C:\Users\Admin\AppData\Local\Temp\2086b8409ea31624c1d25581d4729ad48f3cde3a3b4969f2c9b79ca6ae6c354a.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im k4.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
C:\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\Class.dllFilesize
47KB
MD5489c64a28a4295f0927e530632af0c34
SHA17787a8a54513c590bb9ac8539229efc508cee774
SHA2563bccac3eb915a400ada9ef06c9b576a330e217a5a35f8c8c87612c0273b276c6
SHA512c82f242762f0bff06fc85fa4710681fee7538643da546990bca19befcd375ac03e5cf7fa4acc234bee401df4be95ac33933b0c6f6adb2868c23ac3cbe9fd806f
-
\Users\Public\Documents\Class.dllFilesize
47KB
MD5489c64a28a4295f0927e530632af0c34
SHA17787a8a54513c590bb9ac8539229efc508cee774
SHA2563bccac3eb915a400ada9ef06c9b576a330e217a5a35f8c8c87612c0273b276c6
SHA512c82f242762f0bff06fc85fa4710681fee7538643da546990bca19befcd375ac03e5cf7fa4acc234bee401df4be95ac33933b0c6f6adb2868c23ac3cbe9fd806f
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
\Users\Public\Documents\k4.exeFilesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
memory/852-65-0x0000000000000000-mapping.dmp
-
memory/852-65-0x0000000000000000-mapping.dmp
-
memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1756-64-0x0000000000000000-mapping.dmp
-
memory/1756-64-0x0000000000000000-mapping.dmp
-
memory/2028-57-0x0000000000000000-mapping.dmp
-
memory/2028-59-0x000007FEFB761000-0x000007FEFB763000-memory.dmpFilesize
8KB
-
memory/2028-59-0x000007FEFB761000-0x000007FEFB763000-memory.dmpFilesize
8KB
-
memory/2028-57-0x0000000000000000-mapping.dmp
-
memory/2036-61-0x0000000000000000-mapping.dmp
-
memory/2036-61-0x0000000000000000-mapping.dmp