Analysis
-
max time kernel
159s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-11-2022 12:45
General
-
Target
ef88ebcdb725a3515097e271e0dd5b7e735100605aa82ef734de7c1f902b95ef.exe
-
Size
517KB
-
MD5
4faedbf756856dfc8305187fe3eb12f9
-
SHA1
20765f7138e063f1e9f7cc474cd842bcd146f6ec
-
SHA256
ef88ebcdb725a3515097e271e0dd5b7e735100605aa82ef734de7c1f902b95ef
-
SHA512
446c639dea2bc4119ec9625a057c166502eb26c562c806cd6b28a69490fd216f0b0f58f64ab054162fcdcdfab4c4d8933c2ccd20b1ba0a3f70c13f4be3d7b87e
-
SSDEEP
12288:96RafPsMXfnOr/LeJa6IEzWdiBtwxG+buDS:oRaXxvOjL6SIDwBuO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef88ebcdb725a3515097e271e0dd5b7e735100605aa82ef734de7c1f902b95ef.exe"C:\Users\Admin\AppData\Local\Temp\ef88ebcdb725a3515097e271e0dd5b7e735100605aa82ef734de7c1f902b95ef.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\servs.exe"C:\Users\Admin\AppData\Roaming\servs.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\servs.exe" "servs.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\servs.exeFilesize
517KB
MD54faedbf756856dfc8305187fe3eb12f9
SHA120765f7138e063f1e9f7cc474cd842bcd146f6ec
SHA256ef88ebcdb725a3515097e271e0dd5b7e735100605aa82ef734de7c1f902b95ef
SHA512446c639dea2bc4119ec9625a057c166502eb26c562c806cd6b28a69490fd216f0b0f58f64ab054162fcdcdfab4c4d8933c2ccd20b1ba0a3f70c13f4be3d7b87e
-
C:\Users\Admin\AppData\Roaming\servs.exeFilesize
517KB
MD54faedbf756856dfc8305187fe3eb12f9
SHA120765f7138e063f1e9f7cc474cd842bcd146f6ec
SHA256ef88ebcdb725a3515097e271e0dd5b7e735100605aa82ef734de7c1f902b95ef
SHA512446c639dea2bc4119ec9625a057c166502eb26c562c806cd6b28a69490fd216f0b0f58f64ab054162fcdcdfab4c4d8933c2ccd20b1ba0a3f70c13f4be3d7b87e
-
memory/1204-54-0x000007FEF4E60000-0x000007FEF5883000-memory.dmpFilesize
10.1MB
-
memory/1204-55-0x000007FEF3B80000-0x000007FEF4C16000-memory.dmpFilesize
16.6MB
-
memory/1204-56-0x000007FEFC101000-0x000007FEFC103000-memory.dmpFilesize
8KB
-
memory/2000-62-0x0000000000000000-mapping.dmp
-
memory/2024-57-0x0000000000000000-mapping.dmp
-
memory/2024-60-0x000007FEF4E60000-0x000007FEF5883000-memory.dmpFilesize
10.1MB
-
memory/2024-61-0x000007FEF3B80000-0x000007FEF4C16000-memory.dmpFilesize
16.6MB
-
memory/2024-64-0x0000000000A26000-0x0000000000A45000-memory.dmpFilesize
124KB
-
memory/2024-65-0x0000000000A26000-0x0000000000A45000-memory.dmpFilesize
124KB