Analysis
-
max time kernel
314s -
max time network
328s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:36
Static task
static1
Behavioral task
behavioral1
Sample
f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe
Resource
win10v2004-20221111-en
General
-
Target
f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe
-
Size
558KB
-
MD5
1536f2e822680238ec0b6928b5726bfc
-
SHA1
e8925fb80018d643412c248bb3a3b4e2ce1b6b31
-
SHA256
f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3
-
SHA512
02b1c2b47497a7e19af21c4dd679bb17695b14b2b9bc14ae767cd1ffc55c6325f3a3637fa8a6968b30f3e97d8cce0471890c24f003ae8880a9b605796de24bad
-
SSDEEP
12288:C2hB6DQbf9yCJnVUtHFb/LXCVhq25qeCYUXB65rFBny5KTK:uD0f8CJ+Fb/LCRqycB65Lq
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exepid process 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exenet.exenet.exedescription pid process target process PID 1252 wrote to memory of 4404 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe net.exe PID 1252 wrote to memory of 4404 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe net.exe PID 1252 wrote to memory of 4404 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe net.exe PID 4404 wrote to memory of 2908 4404 net.exe net1.exe PID 4404 wrote to memory of 2908 4404 net.exe net1.exe PID 4404 wrote to memory of 2908 4404 net.exe net1.exe PID 1252 wrote to memory of 2008 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe net.exe PID 1252 wrote to memory of 2008 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe net.exe PID 1252 wrote to memory of 2008 1252 f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe net.exe PID 2008 wrote to memory of 1560 2008 net.exe net1.exe PID 2008 wrote to memory of 1560 2008 net.exe net1.exe PID 2008 wrote to memory of 1560 2008 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe"C:\Users\Admin\AppData\Local\Temp\f2f4390b13840bca6a2f4acae0eaa61c4c8a92f6fbde27f064304edfc4f4d0d3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsw907C.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
C:\Users\Admin\AppData\Local\Temp\nsw907C.tmp\nsExec.dllFilesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
C:\Users\Admin\AppData\Local\Temp\nsw907C.tmp\nsExec.dllFilesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
C:\Users\Admin\AppData\Local\Temp\nsw907C.tmp\nsExec.dllFilesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
C:\Users\Admin\AppData\Local\Temp\nsw907C.tmp\nsExec.dllFilesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
memory/1252-132-0x0000000000370000-0x00000000007BE000-memory.dmpFilesize
4.3MB
-
memory/1560-141-0x0000000000000000-mapping.dmp
-
memory/2008-140-0x0000000000000000-mapping.dmp
-
memory/2908-137-0x0000000000000000-mapping.dmp
-
memory/4404-136-0x0000000000000000-mapping.dmp