Analysis
-
max time kernel
181s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:49
Static task
static1
Behavioral task
behavioral1
Sample
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe
Resource
win10v2004-20221111-en
General
-
Target
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe
-
Size
898KB
-
MD5
5c41de5cea0bc148b8177cb41803d7c9
-
SHA1
47fbd7205613bd5f451439ccec5b514dbc4c7c0f
-
SHA256
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08
-
SHA512
b0d812109610e8754b3a52b370c37ea188099e2d5ae1ce2fdf5fca4b3a8ef62edb2af87634726bda971efc81704978faa6f52d181167f4f7f8707b334d8450cd
-
SSDEEP
6144:E3i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhDM6a1F9nBG:E3TdtLW5WIj1YSSdFxs1z4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe regsvr.exe" 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Disables Task Manager via registry modification
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msn Messsenger = "C:\\Windows\\system32\\regsvr.exe" 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3424-137-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe -
Drops file in System32 directory 6 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process File opened for modification C:\Windows\SysWOW64\28463 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File created C:\Windows\SysWOW64\regsvr.exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\SysWOW64\regsvr.exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File created C:\Windows\SysWOW64\svchost .exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\SysWOW64\svchost .exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\SysWOW64\setup.ini 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Drops file in Windows directory 2 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process File created C:\Windows\regsvr.exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\regsvr.exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.execmd.execmd.exedescription pid process target process PID 3424 wrote to memory of 2436 3424 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 3424 wrote to memory of 2436 3424 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 3424 wrote to memory of 2436 3424 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 2436 wrote to memory of 3604 2436 cmd.exe at.exe PID 2436 wrote to memory of 3604 2436 cmd.exe at.exe PID 2436 wrote to memory of 3604 2436 cmd.exe at.exe PID 3424 wrote to memory of 3608 3424 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 3424 wrote to memory of 3608 3424 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 3424 wrote to memory of 3608 3424 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 3608 wrote to memory of 4992 3608 cmd.exe at.exe PID 3608 wrote to memory of 4992 3608 cmd.exe at.exe PID 3608 wrote to memory of 4992 3608 cmd.exe at.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe"C:\Users\Admin\AppData\Local\Temp\5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2436-133-0x0000000000000000-mapping.dmp
-
memory/3424-132-0x0000000000400000-0x0000000000506000-memory.dmpFilesize
1.0MB
-
memory/3424-137-0x0000000000400000-0x0000000000506000-memory.dmpFilesize
1.0MB
-
memory/3604-134-0x0000000000000000-mapping.dmp
-
memory/3608-135-0x0000000000000000-mapping.dmp
-
memory/4992-136-0x0000000000000000-mapping.dmp