f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6

General

Target

f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe
Size

444KB
MD5

83b3026498d9489934d8e58f258d1f86
SHA1

8f30b5ec479a7486c468240c79aa8e2c0632d8a0
SHA256

f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6
SHA512

05d2c191377fb3558b1266698ea14a407408bbb2946c2bf2e2a70d6d99effe871b3413b0f793de22b3da8819401b2faf285278b83adabdc210566040c69ff1ad
SSDEEP

6144:vPijNIqf0BeaXxfSp8dBLUFj5ZuMIsl5UbdG4XXU83x46f2:3iZjMTXldBLUos+BGGX/b

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

gwxwipohp.exe

pid process

1532 gwxwipohp.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

944 cmd.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exegwxwipohp.exe

pid process

944 cmd.exe
944 cmd.exe
1532 gwxwipohp.exe

pid	process
1532	gwxwipohp.exe

pid	process
944	cmd.exe

pid	process
944	cmd.exe
944	cmd.exe
1532	gwxwipohp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

668 taskkill.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2000 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 668 taskkill.exe

pid	process
668	taskkill.exe

pid	process
2000	PING.EXE

description	pid	process
Token: SeDebugPrivilege	668	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.execmd.exe

description	pid	process	target process
PID 1048 wrote to memory of 944	1048	f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe	cmd.exe
PID 1048 wrote to memory of 944	1048	f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe	cmd.exe
PID 1048 wrote to memory of 944	1048	f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe	cmd.exe
PID 1048 wrote to memory of 944	1048	f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe	cmd.exe
PID 944 wrote to memory of 668	944	cmd.exe	taskkill.exe
PID 944 wrote to memory of 668	944	cmd.exe	taskkill.exe
PID 944 wrote to memory of 668	944	cmd.exe	taskkill.exe
PID 944 wrote to memory of 668	944	cmd.exe	taskkill.exe
PID 944 wrote to memory of 2000	944	cmd.exe	PING.EXE
PID 944 wrote to memory of 2000	944	cmd.exe	PING.EXE
PID 944 wrote to memory of 2000	944	cmd.exe	PING.EXE
PID 944 wrote to memory of 2000	944	cmd.exe	PING.EXE
PID 944 wrote to memory of 1532	944	cmd.exe	gwxwipohp.exe
PID 944 wrote to memory of 1532	944	cmd.exe	gwxwipohp.exe
PID 944 wrote to memory of 1532	944	cmd.exe	gwxwipohp.exe
PID 944 wrote to memory of 1532	944	cmd.exe	gwxwipohp.exe

C:\Users\Admin\AppData\Local\Temp\f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe
"C:\Users\Admin\AppData\Local\Temp\f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1048 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6.exe" & start C:\Users\Admin\AppData\Local\GWXWIP~1.EXE -f
2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /pid 1048
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Windows\SysWOW64\PING.EXE
ping -n 3 127.1
3⤵
- Runs ping.exe
PID:2000

C:\Users\Admin\AppData\Local\gwxwipohp.exe
C:\Users\Admin\AppData\Local\GWXWIP~1.EXE -f
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\gwxwipohp.exe

Filesize
444KB

MD5
83b3026498d9489934d8e58f258d1f86

SHA1
8f30b5ec479a7486c468240c79aa8e2c0632d8a0

SHA256
f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6

SHA512
05d2c191377fb3558b1266698ea14a407408bbb2946c2bf2e2a70d6d99effe871b3413b0f793de22b3da8819401b2faf285278b83adabdc210566040c69ff1ad

Download Submit
C:\Users\Admin\AppData\Local\gwxwipohp.exe

Filesize
444KB

MD5
83b3026498d9489934d8e58f258d1f86

SHA1
8f30b5ec479a7486c468240c79aa8e2c0632d8a0

SHA256
f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6

SHA512
05d2c191377fb3558b1266698ea14a407408bbb2946c2bf2e2a70d6d99effe871b3413b0f793de22b3da8819401b2faf285278b83adabdc210566040c69ff1ad

Download Submit
\Users\Admin\AppData\Local\gwxwipohp.exe

Filesize
444KB

MD5
83b3026498d9489934d8e58f258d1f86

SHA1
8f30b5ec479a7486c468240c79aa8e2c0632d8a0

SHA256
f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6

SHA512
05d2c191377fb3558b1266698ea14a407408bbb2946c2bf2e2a70d6d99effe871b3413b0f793de22b3da8819401b2faf285278b83adabdc210566040c69ff1ad

Download Submit
\Users\Admin\AppData\Local\gwxwipohp.exe

Filesize
444KB

MD5
83b3026498d9489934d8e58f258d1f86

SHA1
8f30b5ec479a7486c468240c79aa8e2c0632d8a0

SHA256
f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6

SHA512
05d2c191377fb3558b1266698ea14a407408bbb2946c2bf2e2a70d6d99effe871b3413b0f793de22b3da8819401b2faf285278b83adabdc210566040c69ff1ad

Download Submit
\Users\Admin\AppData\Local\gwxwipohp.exe

Filesize
444KB

MD5
83b3026498d9489934d8e58f258d1f86

SHA1
8f30b5ec479a7486c468240c79aa8e2c0632d8a0

SHA256
f87314498e407f9ac95f8c13d8d942ae3ec4e3fad21a3f3be2b83ceaf591b8c6

SHA512
05d2c191377fb3558b1266698ea14a407408bbb2946c2bf2e2a70d6d99effe871b3413b0f793de22b3da8819401b2faf285278b83adabdc210566040c69ff1ad

Download Submit
memory/668-57-0x0000000000000000-mapping.dmp

Download
memory/944-55-0x0000000000000000-mapping.dmp

Download
memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1048-56-0x0000000001000000-0x00000000010A7000-memory.dmp

Filesize
668KB

Download
memory/1532-62-0x0000000000000000-mapping.dmp

Download
memory/1532-66-0x0000000001000000-0x00000000010A7000-memory.dmp

Filesize
668KB

Download
memory/1532-67-0x0000000001000000-0x00000000010A7000-memory.dmp

Filesize
668KB

Download
memory/2000-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing