Analysis
-
max time kernel
188s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:51
Static task
static1
Behavioral task
behavioral1
Sample
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe
Resource
win10v2004-20221111-en
General
-
Target
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe
-
Size
710KB
-
MD5
b41be72917631662b809a97398b1cc2f
-
SHA1
86ffe8c475013335a595e45e61555d218c83ed6c
-
SHA256
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55
-
SHA512
e6bd8298c1df98ca1d2954d419032d559afd17e55f82dcc9840114c7f8a0bb85b1eb74f84d832b172a4ba59f32fe1770db4419909fb73e83a96dacd3a79b8b39
-
SSDEEP
12288:8CcefLVxfez9WRoEwnHKMrMCFJEHylS43u6Zmpin3J:wQLV8zcRoTjw+JFsin
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe -
Executes dropped EXE 1 IoCs
Processes:
notepad .exepid process 768 notepad .exe -
Loads dropped DLL 1 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exepid process 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exedescription pid process target process PID 2024 set thread context of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exepid process 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
notepad .exepid process 768 notepad .exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exenotepad .exedescription pid process Token: SeDebugPrivilege 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe Token: SeDebugPrivilege 768 notepad .exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
notepad .exepid process 768 notepad .exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.execmd.exewscript.exedescription pid process target process PID 2024 wrote to memory of 1212 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe cmd.exe PID 2024 wrote to memory of 1212 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe cmd.exe PID 2024 wrote to memory of 1212 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe cmd.exe PID 2024 wrote to memory of 1212 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe cmd.exe PID 1212 wrote to memory of 268 1212 cmd.exe wscript.exe PID 1212 wrote to memory of 268 1212 cmd.exe wscript.exe PID 1212 wrote to memory of 268 1212 cmd.exe wscript.exe PID 1212 wrote to memory of 268 1212 cmd.exe wscript.exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 2024 wrote to memory of 768 2024 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 268 wrote to memory of 1852 268 wscript.exe cmd.exe PID 268 wrote to memory of 1852 268 wscript.exe cmd.exe PID 268 wrote to memory of 1852 268 wscript.exe cmd.exe PID 268 wrote to memory of 1852 268 wscript.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe"C:\Users\Admin\AppData\Local\Temp\e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\\mata.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "4⤵
-
C:\Users\Admin\AppData\Local\Temp\notepad .exe"C:\Users\Admin\AppData\Local\Temp\notepad .exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\file.exeFilesize
710KB
MD5b41be72917631662b809a97398b1cc2f
SHA186ffe8c475013335a595e45e61555d218c83ed6c
SHA256e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55
SHA512e6bd8298c1df98ca1d2954d419032d559afd17e55f82dcc9840114c7f8a0bb85b1eb74f84d832b172a4ba59f32fe1770db4419909fb73e83a96dacd3a79b8b39
-
C:\Users\Admin\AppData\Local\Temp\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\mata.batFilesize
47B
MD558c538a6ae20a3c6031217903cdf8e5d
SHA1399fd50eadf4945b665877facfc4f53d16e18b1e
SHA2566bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
SHA512c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359
-
C:\Users\Admin\AppData\Local\Temp\mata2.batFilesize
47B
MD5095b2908ae8b2e0e3704c0163f26e283
SHA13429b6c1421d448c98c1da9625badcea2484a521
SHA25622b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
SHA512e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
52KB
MD5278edbd499374bf73621f8c1f969d894
SHA1a81170af14747781c5f5f51bb1215893136f0bc0
SHA256c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA51293b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
52KB
MD5278edbd499374bf73621f8c1f969d894
SHA1a81170af14747781c5f5f51bb1215893136f0bc0
SHA256c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA51293b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9
-
C:\Users\Admin\AppData\Local\Temp\rundll11-.txtFilesize
710KB
MD5b41be72917631662b809a97398b1cc2f
SHA186ffe8c475013335a595e45e61555d218c83ed6c
SHA256e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55
SHA512e6bd8298c1df98ca1d2954d419032d559afd17e55f82dcc9840114c7f8a0bb85b1eb74f84d832b172a4ba59f32fe1770db4419909fb73e83a96dacd3a79b8b39
-
\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
52KB
MD5278edbd499374bf73621f8c1f969d894
SHA1a81170af14747781c5f5f51bb1215893136f0bc0
SHA256c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA51293b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9
-
memory/268-58-0x0000000000000000-mapping.dmp
-
memory/768-75-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/768-72-0x00000000004465CE-mapping.dmp
-
memory/768-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/768-81-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/768-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/768-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/768-80-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/768-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/768-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/768-77-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1212-56-0x0000000000000000-mapping.dmp
-
memory/1852-68-0x0000000000000000-mapping.dmp
-
memory/2024-54-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB
-
memory/2024-71-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/2024-55-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/2024-83-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB