Analysis
-
max time kernel
150s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:16
Static task
static1
Behavioral task
behavioral1
Sample
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe
Resource
win7-20220812-en
General
-
Target
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe
-
Size
875KB
-
MD5
0a73ff03793f0b5beb7d2537933033ab
-
SHA1
9631cedd0844c8c7fb16373c27e0c9ffb7261f9a
-
SHA256
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563
-
SHA512
4131c9e9bbdd3618cdda5cf00b98f2d2254e63ce6a6d5bafda9bd6430e3c555e6361227bfe89072e83f46e0dd4c8d306b9337570800760bb612917c17517d703
-
SSDEEP
24576:h4lavt0LkLL9IMixoEgea+8zrcq9MmCS:wkwkn9IMHea+GQaPCS
Malware Config
Signatures
-
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe -
Executes dropped EXE 2 IoCs
Processes:
7163.exetext.exepid process 1004 7163.exe 864 text.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
text.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\03bfd3da23b9ce746a9cdacb3e8222d9.exe text.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\03bfd3da23b9ce746a9cdacb3e8222d9.exe text.exe -
Loads dropped DLL 4 IoCs
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe7163.exepid process 1932 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 1932 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 1932 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 1004 7163.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
text.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\03bfd3da23b9ce746a9cdacb3e8222d9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\text.exe\" .." text.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\03bfd3da23b9ce746a9cdacb3e8222d9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\text.exe\" .." text.exe -
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
text.exepid process 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe 864 text.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
text.exedescription pid process Token: SeDebugPrivilege 864 text.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe7163.exetext.exedescription pid process target process PID 1932 wrote to memory of 1004 1932 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 7163.exe PID 1932 wrote to memory of 1004 1932 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 7163.exe PID 1932 wrote to memory of 1004 1932 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 7163.exe PID 1932 wrote to memory of 1004 1932 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 7163.exe PID 1004 wrote to memory of 864 1004 7163.exe text.exe PID 1004 wrote to memory of 864 1004 7163.exe text.exe PID 1004 wrote to memory of 864 1004 7163.exe text.exe PID 1004 wrote to memory of 864 1004 7163.exe text.exe PID 864 wrote to memory of 2012 864 text.exe netsh.exe PID 864 wrote to memory of 2012 864 text.exe netsh.exe PID 864 wrote to memory of 2012 864 text.exe netsh.exe PID 864 wrote to memory of 2012 864 text.exe netsh.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe"C:\Users\Admin\AppData\Local\Temp\90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\7163\7163.exe"C:\Users\Admin\AppData\Local\Temp\7163\7163.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\text.exe"C:\Users\Admin\AppData\Roaming\text.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\text.exe" "text.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7163\7163.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
C:\Users\Admin\AppData\Local\Temp\7163\7163.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
C:\Users\Admin\AppData\Roaming\text.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
C:\Users\Admin\AppData\Roaming\text.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
\Users\Admin\AppData\Local\Temp\7163\7163.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
\Users\Admin\AppData\Local\Temp\7163\7163.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
\Users\Admin\AppData\Local\Temp\7163\7163.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
\Users\Admin\AppData\Roaming\text.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
memory/864-64-0x0000000000000000-mapping.dmp
-
memory/864-69-0x0000000073C40000-0x00000000741EB000-memory.dmpFilesize
5.7MB
-
memory/864-71-0x0000000073C40000-0x00000000741EB000-memory.dmpFilesize
5.7MB
-
memory/1004-62-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/1004-58-0x0000000000000000-mapping.dmp
-
memory/1932-54-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/2012-68-0x0000000000000000-mapping.dmp