Analysis
-
max time kernel
203s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:03
Behavioral task
behavioral1
Sample
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe
Resource
win10v2004-20221111-en
General
-
Target
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe
-
Size
134KB
-
MD5
5d8b2924913d123783f8c9836a502894
-
SHA1
0701c16319677842d7c1a63efd0fce1a6e9f023b
-
SHA256
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8
-
SHA512
8c5ed264db9a3042d7a09f64fba92df4949a5e77c005f95158624c63c6eddcc03fc9c770af1290f40781caee63c6703f6638123272b63ec263bdd4fadeac5e9b
-
SSDEEP
3072:Dxaw7lEvFCsE8uKqMJBrHnsAWNqubkdBytQlaVrAUdB1/:TlFstuKqMJ9Hn5WNqub/tpV841
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
trys.exetrys.exetrys.exepid process 1424 trys.exe 928 trys.exe 1680 trys.exe -
Processes:
resource yara_rule behavioral1/memory/332-54-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral1/memory/1512-58-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1512-60-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1512-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/332-64-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral1/memory/1512-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1512-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1512-69-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Windows\trys.exe upx behavioral1/memory/1512-78-0x0000000002C70000-0x0000000002CE0000-memory.dmp upx behavioral1/memory/1424-80-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral1/memory/1680-90-0x0000000013140000-0x0000000013162000-memory.dmp upx C:\Windows\trys.exe upx behavioral1/memory/1680-94-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral1/memory/1680-96-0x0000000013140000-0x0000000013162000-memory.dmp upx C:\Windows\trys.exe upx behavioral1/memory/1424-101-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral1/memory/1512-103-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/928-104-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1680-105-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral1/memory/1680-107-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral1/memory/1680-108-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral1/memory/1680-109-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral1/memory/928-110-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1680-111-0x0000000013140000-0x0000000013162000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Windows\\trys.exe" reg.exe -
Processes:
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exetrys.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA trys.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exetrys.exedescription pid process target process PID 332 set thread context of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 1424 set thread context of 928 1424 trys.exe trys.exe PID 1424 set thread context of 1680 1424 trys.exe trys.exe -
Drops file in Windows directory 2 IoCs
Processes:
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exedescription ioc process File created C:\Windows\trys.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe File opened for modification C:\Windows\trys.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
trys.exedescription pid process Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe Token: SeDebugPrivilege 928 trys.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exetrys.exetrys.exepid process 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 1424 trys.exe 928 trys.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.execmd.exetrys.exedescription pid process target process PID 332 wrote to memory of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 332 wrote to memory of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 332 wrote to memory of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 332 wrote to memory of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 332 wrote to memory of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 332 wrote to memory of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 332 wrote to memory of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 332 wrote to memory of 1512 332 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe PID 1512 wrote to memory of 904 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe cmd.exe PID 1512 wrote to memory of 904 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe cmd.exe PID 1512 wrote to memory of 904 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe cmd.exe PID 1512 wrote to memory of 904 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe cmd.exe PID 904 wrote to memory of 2008 904 cmd.exe reg.exe PID 904 wrote to memory of 2008 904 cmd.exe reg.exe PID 904 wrote to memory of 2008 904 cmd.exe reg.exe PID 904 wrote to memory of 2008 904 cmd.exe reg.exe PID 1512 wrote to memory of 1424 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe trys.exe PID 1512 wrote to memory of 1424 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe trys.exe PID 1512 wrote to memory of 1424 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe trys.exe PID 1512 wrote to memory of 1424 1512 62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe trys.exe PID 1424 wrote to memory of 928 1424 trys.exe trys.exe PID 1424 wrote to memory of 928 1424 trys.exe trys.exe PID 1424 wrote to memory of 928 1424 trys.exe trys.exe PID 1424 wrote to memory of 928 1424 trys.exe trys.exe PID 1424 wrote to memory of 928 1424 trys.exe trys.exe PID 1424 wrote to memory of 928 1424 trys.exe trys.exe PID 1424 wrote to memory of 928 1424 trys.exe trys.exe PID 1424 wrote to memory of 928 1424 trys.exe trys.exe PID 1424 wrote to memory of 1680 1424 trys.exe trys.exe PID 1424 wrote to memory of 1680 1424 trys.exe trys.exe PID 1424 wrote to memory of 1680 1424 trys.exe trys.exe PID 1424 wrote to memory of 1680 1424 trys.exe trys.exe PID 1424 wrote to memory of 1680 1424 trys.exe trys.exe PID 1424 wrote to memory of 1680 1424 trys.exe trys.exe PID 1424 wrote to memory of 1680 1424 trys.exe trys.exe PID 1424 wrote to memory of 1680 1424 trys.exe trys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe"C:\Users\Admin\AppData\Local\Temp\62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe"C:\Users\Admin\AppData\Local\Temp\62f4505fcc2dc496eee01cfd8b092d4f66b4d107a6d52e887907647cc177c1f8.exe"2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\VYXLP.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Windows\trys.exe" /f4⤵
- Adds Run key to start application
-
C:\Windows\trys.exe"C:\Windows\trys.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\trys.exe"C:\Windows\trys.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\trys.exe"C:\Windows\trys.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VYXLP.batFilesize
115B
MD5721f40b829b989f3ed90feba41b75b51
SHA10bc3e723b65a94c6ffbb8e0b32c9aaa24d10fefd
SHA256641cbc8ccc1d7ffe1030ff40ea930cad57a855c5fa275bff57745b62d4545a15
SHA512d11fa35712baa83380b1515242d85c1ce84ade1bd3e62144906b40c6e2d42c748d7813faaf05e5514048be3ae47fb29986e0a808c93eabf7128f31300c4d972f
-
C:\Windows\trys.exeFilesize
134KB
MD59a1c53e85ef73cff5f8e46dc5478a468
SHA14c7c8487d5874dea802b07a85c812874bd03d91b
SHA256adbba712bcb73e8748c88329e585a1827547ccd73005e96575a0e9694c80f5c9
SHA5122924435395d4bc5314af76e303b90996d2b29b07bec5c59915c8090efc2115a115a894cc4e6f897d885ae8ec9fe2973d7a7c43aee60c7f82f588042668e8b447
-
C:\Windows\trys.exeFilesize
134KB
MD59a1c53e85ef73cff5f8e46dc5478a468
SHA14c7c8487d5874dea802b07a85c812874bd03d91b
SHA256adbba712bcb73e8748c88329e585a1827547ccd73005e96575a0e9694c80f5c9
SHA5122924435395d4bc5314af76e303b90996d2b29b07bec5c59915c8090efc2115a115a894cc4e6f897d885ae8ec9fe2973d7a7c43aee60c7f82f588042668e8b447
-
C:\Windows\trys.exeFilesize
134KB
MD59a1c53e85ef73cff5f8e46dc5478a468
SHA14c7c8487d5874dea802b07a85c812874bd03d91b
SHA256adbba712bcb73e8748c88329e585a1827547ccd73005e96575a0e9694c80f5c9
SHA5122924435395d4bc5314af76e303b90996d2b29b07bec5c59915c8090efc2115a115a894cc4e6f897d885ae8ec9fe2973d7a7c43aee60c7f82f588042668e8b447
-
memory/332-54-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/332-64-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/904-71-0x0000000000000000-mapping.dmp
-
memory/928-110-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/928-104-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/928-86-0x00000000004085D0-mapping.dmp
-
memory/1424-101-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/1424-74-0x0000000000000000-mapping.dmp
-
memory/1424-80-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/1512-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1512-62-0x00000000004085D0-mapping.dmp
-
memory/1512-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1512-78-0x0000000002C70000-0x0000000002CE0000-memory.dmpFilesize
448KB
-
memory/1512-79-0x0000000002C70000-0x0000000002CE0000-memory.dmpFilesize
448KB
-
memory/1512-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1512-70-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB
-
memory/1512-103-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1512-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1512-60-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1512-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1512-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1680-88-0x0000000013140000-0x0000000013162000-memory.dmpFilesize
136KB
-
memory/1680-111-0x0000000013140000-0x0000000013162000-memory.dmpFilesize
136KB
-
memory/1680-98-0x000000001315FF70-mapping.dmp
-
memory/1680-90-0x0000000013140000-0x0000000013162000-memory.dmpFilesize
136KB
-
memory/1680-105-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/1680-107-0x0000000013140000-0x0000000013162000-memory.dmpFilesize
136KB
-
memory/1680-108-0x0000000013140000-0x0000000013162000-memory.dmpFilesize
136KB
-
memory/1680-109-0x0000000013140000-0x0000000013162000-memory.dmpFilesize
136KB
-
memory/1680-94-0x0000000013140000-0x0000000013162000-memory.dmpFilesize
136KB
-
memory/1680-96-0x0000000013140000-0x0000000013162000-memory.dmpFilesize
136KB
-
memory/2008-73-0x0000000000000000-mapping.dmp