Analysis
-
max time kernel
132s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:50
Static task
static1
Behavioral task
behavioral1
Sample
e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe
Resource
win10v2004-20220812-en
General
-
Target
e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe
-
Size
471KB
-
MD5
ca30e693e0a77051d010b82ebe469153
-
SHA1
fbd2fae427ba661f761d65cd17ff62dad4bced8c
-
SHA256
e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28
-
SHA512
13d5afe719575208a87b599d19fee7cb486f1e512744b75725a7dc4a920f81bc0e610fa0910d8fe9a9f5dcf0e7934f8493b5318b33ad74dbb2a9798f71cb652c
-
SSDEEP
6144:Nmsyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6XjY/:5pO3StxwGc2c3tfmfsCRA22+m+8c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
worker.exepid process 832 worker.exe -
Loads dropped DLL 1 IoCs
Processes:
e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exepid process 1200 e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
worker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main worker.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
worker.exedescription pid process Token: SeDebugPrivilege 832 worker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
worker.exepid process 832 worker.exe 832 worker.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exedescription pid process target process PID 1200 wrote to memory of 832 1200 e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe worker.exe PID 1200 wrote to memory of 832 1200 e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe worker.exe PID 1200 wrote to memory of 832 1200 e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe worker.exe PID 1200 wrote to memory of 832 1200 e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe worker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe"C:\Users\Admin\AppData\Local\Temp\e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DM\parent.txtFilesize
471KB
MD5ca30e693e0a77051d010b82ebe469153
SHA1fbd2fae427ba661f761d65cd17ff62dad4bced8c
SHA256e5588aef6afd35bb77e1d48b4cdff5cd3518032c1800d15f4b0258d2861e5d28
SHA51213d5afe719575208a87b599d19fee7cb486f1e512744b75725a7dc4a920f81bc0e610fa0910d8fe9a9f5dcf0e7934f8493b5318b33ad74dbb2a9798f71cb652c
-
C:\Users\Admin\AppData\Local\Temp\DM\worker.exeFilesize
19KB
MD52b23c69b68708c14fc214c3454e6b1bd
SHA15c923d25c14ad13dab4f05bb1423026f873e7dc4
SHA256b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd
SHA51200135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5
-
C:\Users\Admin\AppData\Local\Temp\DM\worker.exeFilesize
19KB
MD52b23c69b68708c14fc214c3454e6b1bd
SHA15c923d25c14ad13dab4f05bb1423026f873e7dc4
SHA256b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd
SHA51200135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5
-
\Users\Admin\AppData\Local\Temp\DM\worker.exeFilesize
19KB
MD52b23c69b68708c14fc214c3454e6b1bd
SHA15c923d25c14ad13dab4f05bb1423026f873e7dc4
SHA256b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd
SHA51200135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5
-
memory/832-56-0x0000000000000000-mapping.dmp
-
memory/832-59-0x000007FEF37E0000-0x000007FEF4203000-memory.dmpFilesize
10.1MB
-
memory/832-60-0x000007FEF2740000-0x000007FEF37D6000-memory.dmpFilesize
16.6MB
-
memory/832-61-0x000007FEFC001000-0x000007FEFC003000-memory.dmpFilesize
8KB
-
memory/1200-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB