Analysis
-
max time kernel
151s -
max time network
64s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:39
Static task
static1
Behavioral task
behavioral1
Sample
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe
Resource
win10v2004-20220812-en
General
-
Target
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe
-
Size
110KB
-
MD5
4097cecc9d744ab90952f06201687fec
-
SHA1
acd495700fe471ff920cfef79d60a690d472cebb
-
SHA256
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6
-
SHA512
4375a51837ce76cd7f474386728e126842d3212b1f21a988f49e8f5a76ecf66e4af5a86042638f1a1a004f424c6c099c74f0e0d1c65e4015760a2eff421af329
-
SSDEEP
3072:hCARRIiUzPB7DFWE3iHlK+3DjFQiTQ+xCiPvhZNExEY:hNut5v67LCivhZNEx
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H723CA60-7GD4-SJ17-2HL8-EE882DXF4W4G} 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H723CA60-7GD4-SJ17-2HL8-EE882DXF4W4G}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe\"" 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe -
Loads dropped DLL 1 IoCs
Processes:
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exepid process 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe" 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WinApp\\GoogleUpdate.exe.lnk" reg.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exedescription pid process target process PID 1808 set thread context of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exepid process 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exedescription pid process Token: SeDebugPrivilege 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.execmd.exedescription pid process target process PID 1808 wrote to memory of 544 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe cmd.exe PID 1808 wrote to memory of 544 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe cmd.exe PID 1808 wrote to memory of 544 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe cmd.exe PID 1808 wrote to memory of 544 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe cmd.exe PID 544 wrote to memory of 1112 544 cmd.exe reg.exe PID 544 wrote to memory of 1112 544 cmd.exe reg.exe PID 544 wrote to memory of 1112 544 cmd.exe reg.exe PID 544 wrote to memory of 1112 544 cmd.exe reg.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe PID 1808 wrote to memory of 552 1808 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe 3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe"C:\Users\Admin\AppData\Local\Temp\3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "GoogleUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "GoogleUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe.lnk"3⤵
- Adds Run key to start application
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe"C:\Users\Admin\AppData\Local\Temp\3123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6.exe"2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110KB
MD54097cecc9d744ab90952f06201687fec
SHA1acd495700fe471ff920cfef79d60a690d472cebb
SHA2563123f81dacea1173ae18aa0944df82d57f2465ba148216793f04ecee476304e6
SHA5124375a51837ce76cd7f474386728e126842d3212b1f21a988f49e8f5a76ecf66e4af5a86042638f1a1a004f424c6c099c74f0e0d1c65e4015760a2eff421af329