Analysis
-
max time kernel
151s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:54
Static task
static1
Behavioral task
behavioral1
Sample
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
Resource
win10v2004-20220812-en
General
-
Target
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
-
Size
533KB
-
MD5
6b6213539afc18332b63b710ab9570bc
-
SHA1
a3fbb4a82ef989bc8b97bc429251032e47aa1eb6
-
SHA256
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7
-
SHA512
71fea4bb4bea40566b21f4057d013eb2e16a57b5e3a17a9c351be4c523a3271ebdcffadb916b545fe995ffc38443969f0e07346517b07cd6c3fc8fa55680972e
-
SSDEEP
12288:SDNXmc6yNoW0shQjrscZziDbY26b3KkRwNhcDy7Jf:lzW/ajcD6b6kRwNhNJf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exepid process 1692 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe -
Loads dropped DLL 1 IoCs
Processes:
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exepid process 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk" 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exedescription pid process target process PID 1132 set thread context of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exepid process 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exedescription pid process Token: SeDebugPrivilege 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe Token: SeDebugPrivilege 1692 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exepid process 1692 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exedescription pid process target process PID 1132 wrote to memory of 1384 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe CMD.exe PID 1132 wrote to memory of 1384 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe CMD.exe PID 1132 wrote to memory of 1384 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe CMD.exe PID 1132 wrote to memory of 1384 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe CMD.exe PID 1132 wrote to memory of 1764 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe CMD.exe PID 1132 wrote to memory of 1764 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe CMD.exe PID 1132 wrote to memory of 1764 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe CMD.exe PID 1132 wrote to memory of 1764 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe CMD.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe PID 1132 wrote to memory of 1692 1132 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe"C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe"C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exeFilesize
533KB
MD56b6213539afc18332b63b710ab9570bc
SHA1a3fbb4a82ef989bc8b97bc429251032e47aa1eb6
SHA2567a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7
SHA51271fea4bb4bea40566b21f4057d013eb2e16a57b5e3a17a9c351be4c523a3271ebdcffadb916b545fe995ffc38443969f0e07346517b07cd6c3fc8fa55680972e
-
\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exeFilesize
533KB
MD56b6213539afc18332b63b710ab9570bc
SHA1a3fbb4a82ef989bc8b97bc429251032e47aa1eb6
SHA2567a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7
SHA51271fea4bb4bea40566b21f4057d013eb2e16a57b5e3a17a9c351be4c523a3271ebdcffadb916b545fe995ffc38443969f0e07346517b07cd6c3fc8fa55680972e
-
memory/1132-54-0x0000000075561000-0x0000000075563000-memory.dmpFilesize
8KB
-
memory/1132-55-0x0000000074260000-0x000000007480B000-memory.dmpFilesize
5.7MB
-
memory/1132-56-0x000000000082F000-0x0000000000831000-memory.dmpFilesize
8KB
-
memory/1132-57-0x0000000000829000-0x000000000082B000-memory.dmpFilesize
8KB
-
memory/1132-58-0x000000000082B000-0x000000000082F000-memory.dmpFilesize
16KB
-
memory/1132-59-0x000000000082B000-0x000000000082F000-memory.dmpFilesize
16KB
-
memory/1132-60-0x000000000082B000-0x000000000082D000-memory.dmpFilesize
8KB
-
memory/1132-61-0x000000000082B000-0x000000000082F000-memory.dmpFilesize
16KB
-
memory/1132-62-0x0000000000834000-0x0000000000836000-memory.dmpFilesize
8KB
-
memory/1132-63-0x000000000083B000-0x000000000083F000-memory.dmpFilesize
16KB
-
memory/1132-64-0x000000000083B000-0x000000000083F000-memory.dmpFilesize
16KB
-
memory/1132-65-0x000000000083B000-0x000000000083F000-memory.dmpFilesize
16KB
-
memory/1132-66-0x000000000083D000-0x000000000083F000-memory.dmpFilesize
8KB
-
memory/1132-67-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-68-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-69-0x0000000074260000-0x000000007480B000-memory.dmpFilesize
5.7MB
-
memory/1132-70-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-71-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-72-0x0000000000842000-0x0000000000844000-memory.dmpFilesize
8KB
-
memory/1132-73-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-74-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-75-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-76-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-77-0x000000000082F000-0x0000000000831000-memory.dmpFilesize
8KB
-
memory/1132-78-0x0000000000843000-0x0000000000845000-memory.dmpFilesize
8KB
-
memory/1132-79-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-80-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-81-0x0000000000829000-0x000000000082B000-memory.dmpFilesize
8KB
-
memory/1132-82-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-83-0x0000000000841000-0x0000000000845000-memory.dmpFilesize
16KB
-
memory/1132-84-0x000000000082B000-0x000000000082D000-memory.dmpFilesize
8KB
-
memory/1132-85-0x0000000000844000-0x0000000000846000-memory.dmpFilesize
8KB
-
memory/1132-86-0x0000000000845000-0x0000000000849000-memory.dmpFilesize
16KB
-
memory/1132-87-0x0000000000844000-0x0000000000846000-memory.dmpFilesize
8KB
-
memory/1132-88-0x0000000000845000-0x0000000000849000-memory.dmpFilesize
16KB
-
memory/1132-89-0x0000000000845000-0x0000000000849000-memory.dmpFilesize
16KB
-
memory/1132-90-0x0000000000834000-0x0000000000836000-memory.dmpFilesize
8KB
-
memory/1132-91-0x0000000000845000-0x0000000000849000-memory.dmpFilesize
16KB
-
memory/1132-92-0x0000000000845000-0x0000000000849000-memory.dmpFilesize
16KB
-
memory/1132-93-0x0000000000845000-0x0000000000847000-memory.dmpFilesize
8KB
-
memory/1132-95-0x000000000084E000-0x0000000000850000-memory.dmpFilesize
8KB
-
memory/1132-94-0x000000000083D000-0x000000000083F000-memory.dmpFilesize
8KB
-
memory/1132-97-0x000000000084F000-0x0000000000851000-memory.dmpFilesize
8KB
-
memory/1132-96-0x0000000000842000-0x0000000000844000-memory.dmpFilesize
8KB
-
memory/1132-98-0x0000000000843000-0x0000000000845000-memory.dmpFilesize
8KB
-
memory/1132-99-0x0000000000851000-0x0000000000855000-memory.dmpFilesize
16KB
-
memory/1132-100-0x0000000000850000-0x0000000000852000-memory.dmpFilesize
8KB
-
memory/1132-101-0x0000000000851000-0x0000000000855000-memory.dmpFilesize
16KB
-
memory/1132-102-0x0000000000851000-0x0000000000855000-memory.dmpFilesize
16KB
-
memory/1132-103-0x0000000000851000-0x0000000000855000-memory.dmpFilesize
16KB
-
memory/1132-104-0x0000000000851000-0x0000000000855000-memory.dmpFilesize
16KB
-
memory/1132-106-0x0000000000851000-0x0000000000853000-memory.dmpFilesize
8KB
-
memory/1132-105-0x0000000000844000-0x0000000000846000-memory.dmpFilesize
8KB
-
memory/1132-107-0x0000000000851000-0x0000000000855000-memory.dmpFilesize
16KB
-
memory/1132-108-0x0000000000851000-0x0000000000855000-memory.dmpFilesize
16KB
-
memory/1132-109-0x000000000085D000-0x0000000000861000-memory.dmpFilesize
16KB
-
memory/1132-110-0x000000000085D000-0x0000000000861000-memory.dmpFilesize
16KB
-
memory/1132-111-0x0000000000845000-0x0000000000847000-memory.dmpFilesize
8KB
-
memory/1132-112-0x000000000085D000-0x0000000000861000-memory.dmpFilesize
16KB
-
memory/1132-113-0x000000000085D000-0x0000000000861000-memory.dmpFilesize
16KB
-
memory/1132-115-0x000000000085F000-0x0000000000861000-memory.dmpFilesize
8KB
-
memory/1132-114-0x000000000084E000-0x0000000000850000-memory.dmpFilesize
8KB
-
memory/1132-116-0x000000000085D000-0x0000000000861000-memory.dmpFilesize
16KB
-
memory/1132-117-0x000000000085D000-0x0000000000861000-memory.dmpFilesize
16KB
-
memory/1132-118-0x000000000085D000-0x0000000000861000-memory.dmpFilesize
16KB
-
memory/1132-119-0x0000000000860000-0x0000000000862000-memory.dmpFilesize
8KB
-
memory/1132-120-0x000000000084F000-0x0000000000851000-memory.dmpFilesize
8KB
-
memory/1132-121-0x0000000000860000-0x0000000000862000-memory.dmpFilesize
8KB
-
memory/1132-122-0x0000000000861000-0x0000000000863000-memory.dmpFilesize
8KB
-
memory/1132-123-0x0000000000850000-0x0000000000852000-memory.dmpFilesize
8KB
-
memory/1132-125-0x0000000000862000-0x0000000000864000-memory.dmpFilesize
8KB
-
memory/1132-124-0x0000000000851000-0x0000000000853000-memory.dmpFilesize
8KB
-
memory/1132-126-0x000000000086F000-0x0000000000871000-memory.dmpFilesize
8KB
-
memory/1132-127-0x000000000085F000-0x0000000000861000-memory.dmpFilesize
8KB
-
memory/1132-128-0x0000000000870000-0x0000000000872000-memory.dmpFilesize
8KB
-
memory/1132-129-0x0000000000860000-0x0000000000862000-memory.dmpFilesize
8KB
-
memory/1132-130-0x0000000000871000-0x0000000000873000-memory.dmpFilesize
8KB
-
memory/1132-131-0x0000000000861000-0x0000000000863000-memory.dmpFilesize
8KB
-
memory/1132-132-0x0000000000872000-0x0000000000874000-memory.dmpFilesize
8KB
-
memory/1132-133-0x0000000000880000-0x0000000000882000-memory.dmpFilesize
8KB
-
memory/1132-134-0x000000000086F000-0x0000000000871000-memory.dmpFilesize
8KB
-
memory/1132-135-0x0000000000881000-0x0000000000883000-memory.dmpFilesize
8KB
-
memory/1132-137-0x0000000000882000-0x0000000000884000-memory.dmpFilesize
8KB
-
memory/1132-136-0x0000000000870000-0x0000000000872000-memory.dmpFilesize
8KB
-
memory/1132-139-0x0000000000883000-0x0000000000885000-memory.dmpFilesize
8KB
-
memory/1132-138-0x0000000000871000-0x0000000000873000-memory.dmpFilesize
8KB
-
memory/1132-141-0x000000000088E000-0x0000000000890000-memory.dmpFilesize
8KB
-
memory/1132-140-0x0000000000872000-0x0000000000874000-memory.dmpFilesize
8KB
-
memory/1132-142-0x0000000000880000-0x0000000000882000-memory.dmpFilesize
8KB
-
memory/1132-143-0x000000000088F000-0x0000000000891000-memory.dmpFilesize
8KB
-
memory/1132-144-0x0000000000881000-0x0000000000883000-memory.dmpFilesize
8KB
-
memory/1132-145-0x0000000000890000-0x0000000000892000-memory.dmpFilesize
8KB
-
memory/1132-146-0x0000000000882000-0x0000000000884000-memory.dmpFilesize
8KB
-
memory/1132-147-0x0000000000891000-0x0000000000893000-memory.dmpFilesize
8KB
-
memory/1132-148-0x0000000000883000-0x0000000000885000-memory.dmpFilesize
8KB
-
memory/1132-149-0x000000000088E000-0x0000000000890000-memory.dmpFilesize
8KB
-
memory/1132-150-0x00000000049B0000-0x00000000049B2000-memory.dmpFilesize
8KB
-
memory/1132-151-0x000000000088F000-0x0000000000891000-memory.dmpFilesize
8KB
-
memory/1132-152-0x0000000000890000-0x0000000000892000-memory.dmpFilesize
8KB
-
memory/1132-155-0x0000000000891000-0x0000000000893000-memory.dmpFilesize
8KB
-
memory/1132-171-0x00000000049B0000-0x00000000049B2000-memory.dmpFilesize
8KB
-
memory/1384-153-0x0000000000000000-mapping.dmp
-
memory/1692-157-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1692-158-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1692-160-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1692-161-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1692-162-0x0000000000090000-0x00000000000901A7-memory.dmpFilesize
423B
-
memory/1692-163-0x0000000000090000-mapping.dmp
-
memory/1692-166-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1692-165-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1692-168-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1692-170-0x0000000074260000-0x000000007480B000-memory.dmpFilesize
5.7MB
-
memory/1692-172-0x0000000074260000-0x000000007480B000-memory.dmpFilesize
5.7MB
-
memory/1764-154-0x0000000000000000-mapping.dmp