Analysis
-
max time kernel
53s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:40
Static task
static1
Behavioral task
behavioral1
Sample
77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe
Resource
win10v2004-20220812-en
General
-
Target
77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe
-
Size
198KB
-
MD5
77e7b6334534a6dd535d67b6a6040bcb
-
SHA1
28449665c68297eddcc526e3fd87f683833ff120
-
SHA256
77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea
-
SHA512
6040c8b2d2eebc128997c320f7f799ed01c870004c75bf956f196ae14893f1cf9acb56598344b9e8344df72c996a862335692b198ebe0057b1e18d8652a592c5
-
SSDEEP
3072:mAqnm0E32GhNvv3jPXQyZbAZmIqXKWL/kpTozKbhLw5gX70TJQ1uy4vQID:ynmn2GhNX3jfA0IqXKWIToqr7t7Kf
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Skype.exeSkype.exepid process 1976 Skype.exe 1664 Skype.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Skype.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8e3bc91142bd8d798a10a1667ae4d2be.exe Skype.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8e3bc91142bd8d798a10a1667ae4d2be.exe Skype.exe -
Loads dropped DLL 2 IoCs
Processes:
77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exeSkype.exepid process 1344 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe 1976 Skype.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Skype.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\8e3bc91142bd8d798a10a1667ae4d2be = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Skype.exe\" .." Skype.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8e3bc91142bd8d798a10a1667ae4d2be = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Skype.exe\" .." Skype.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exeSkype.exedescription pid process target process PID 2036 set thread context of 1344 2036 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe PID 1976 set thread context of 1664 1976 Skype.exe Skype.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Skype.exepid process 1664 Skype.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Skype.exedescription pid process Token: SeDebugPrivilege 1664 Skype.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exeSkype.exeSkype.exedescription pid process target process PID 2036 wrote to memory of 1344 2036 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe PID 2036 wrote to memory of 1344 2036 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe PID 2036 wrote to memory of 1344 2036 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe PID 2036 wrote to memory of 1344 2036 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe PID 2036 wrote to memory of 1344 2036 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe PID 2036 wrote to memory of 1344 2036 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe PID 1344 wrote to memory of 1976 1344 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe Skype.exe PID 1344 wrote to memory of 1976 1344 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe Skype.exe PID 1344 wrote to memory of 1976 1344 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe Skype.exe PID 1344 wrote to memory of 1976 1344 77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe Skype.exe PID 1976 wrote to memory of 1664 1976 Skype.exe Skype.exe PID 1976 wrote to memory of 1664 1976 Skype.exe Skype.exe PID 1976 wrote to memory of 1664 1976 Skype.exe Skype.exe PID 1976 wrote to memory of 1664 1976 Skype.exe Skype.exe PID 1976 wrote to memory of 1664 1976 Skype.exe Skype.exe PID 1976 wrote to memory of 1664 1976 Skype.exe Skype.exe PID 1664 wrote to memory of 1096 1664 Skype.exe netsh.exe PID 1664 wrote to memory of 1096 1664 Skype.exe netsh.exe PID 1664 wrote to memory of 1096 1664 Skype.exe netsh.exe PID 1664 wrote to memory of 1096 1664 Skype.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe"C:\Users\Admin\AppData\Local\Temp\77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exeC:\Users\Admin\AppData\Local\Temp\77d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Skype.exe"C:\Users\Admin\AppData\Local\Temp\Skype.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Skype.exeC:\Users\Admin\AppData\Local\Temp\Skype.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Skype.exe" "Skype.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Skype.exeFilesize
198KB
MD577e7b6334534a6dd535d67b6a6040bcb
SHA128449665c68297eddcc526e3fd87f683833ff120
SHA25677d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea
SHA5126040c8b2d2eebc128997c320f7f799ed01c870004c75bf956f196ae14893f1cf9acb56598344b9e8344df72c996a862335692b198ebe0057b1e18d8652a592c5
-
C:\Users\Admin\AppData\Local\Temp\Skype.exeFilesize
198KB
MD577e7b6334534a6dd535d67b6a6040bcb
SHA128449665c68297eddcc526e3fd87f683833ff120
SHA25677d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea
SHA5126040c8b2d2eebc128997c320f7f799ed01c870004c75bf956f196ae14893f1cf9acb56598344b9e8344df72c996a862335692b198ebe0057b1e18d8652a592c5
-
C:\Users\Admin\AppData\Local\Temp\Skype.exeFilesize
198KB
MD577e7b6334534a6dd535d67b6a6040bcb
SHA128449665c68297eddcc526e3fd87f683833ff120
SHA25677d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea
SHA5126040c8b2d2eebc128997c320f7f799ed01c870004c75bf956f196ae14893f1cf9acb56598344b9e8344df72c996a862335692b198ebe0057b1e18d8652a592c5
-
\Users\Admin\AppData\Local\Temp\Skype.exeFilesize
198KB
MD577e7b6334534a6dd535d67b6a6040bcb
SHA128449665c68297eddcc526e3fd87f683833ff120
SHA25677d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea
SHA5126040c8b2d2eebc128997c320f7f799ed01c870004c75bf956f196ae14893f1cf9acb56598344b9e8344df72c996a862335692b198ebe0057b1e18d8652a592c5
-
\Users\Admin\AppData\Local\Temp\Skype.exeFilesize
198KB
MD577e7b6334534a6dd535d67b6a6040bcb
SHA128449665c68297eddcc526e3fd87f683833ff120
SHA25677d9b9488397ddc323b0e2152ca8f4835a912388ce6c9159b5d2191e5514b2ea
SHA5126040c8b2d2eebc128997c320f7f799ed01c870004c75bf956f196ae14893f1cf9acb56598344b9e8344df72c996a862335692b198ebe0057b1e18d8652a592c5
-
memory/1096-83-0x0000000000000000-mapping.dmp
-
memory/1344-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1344-65-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/1344-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1344-58-0x000000000040C51E-mapping.dmp
-
memory/1344-71-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/1344-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1664-85-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/1664-74-0x000000000040C51E-mapping.dmp
-
memory/1664-82-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/1976-79-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/1976-67-0x0000000000000000-mapping.dmp
-
memory/2036-54-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB
-
memory/2036-56-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/2036-55-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/2036-64-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB