Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 02:15
Static task
static1
Behavioral task
behavioral1
Sample
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe
Resource
win10v2004-20220901-en
General
-
Target
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe
-
Size
422KB
-
MD5
554c3f24b05707d2b19bf38507598d76
-
SHA1
d97f51df068df55952aa8c04262bebcad9854d11
-
SHA256
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
-
SHA512
7c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
SSDEEP
6144:T+jJxTnGqaR6rlsG6LbrVSlKR85hIp81G5NQu604EPyl3VQdF02nPVllvjAfTIj:EJMNorlsG6ZR8Z6NZylwFpPVl2Ij
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Intel.exeIntel.exepid process 332 Intel.exe 1212 Intel.exe -
Drops startup file 1 IoCs
Processes:
Intel.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel.com.url Intel.exe -
Loads dropped DLL 3 IoCs
Processes:
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exedw20.exepid process 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe 1740 dw20.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Intel = "C:\\ProgramData\\Intel.exe" reg.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Intel.exeb62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Intel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Intel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Intel.exedescription pid process target process PID 332 set thread context of 1212 332 Intel.exe Intel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
Intel.exepid process 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe 332 Intel.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exeIntel.exedescription pid process Token: SeDebugPrivilege 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Token: SeDebugPrivilege 332 Intel.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.execmd.exeIntel.exedescription pid process target process PID 1224 wrote to memory of 1500 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe cmd.exe PID 1224 wrote to memory of 1500 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe cmd.exe PID 1224 wrote to memory of 1500 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe cmd.exe PID 1224 wrote to memory of 1500 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe cmd.exe PID 1500 wrote to memory of 1784 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1784 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1784 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1784 1500 cmd.exe reg.exe PID 1224 wrote to memory of 332 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Intel.exe PID 1224 wrote to memory of 332 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Intel.exe PID 1224 wrote to memory of 332 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Intel.exe PID 1224 wrote to memory of 332 1224 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1212 332 Intel.exe Intel.exe PID 332 wrote to memory of 1740 332 Intel.exe dw20.exe PID 332 wrote to memory of 1740 332 Intel.exe dw20.exe PID 332 wrote to memory of 1740 332 Intel.exe dw20.exe PID 332 wrote to memory of 1740 332 Intel.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe"C:\Users\Admin\AppData\Local\Temp\b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Intel" /t REG_SZ /d "C:\ProgramData\Intel.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Intel" /t REG_SZ /d "C:\ProgramData\Intel.exe"3⤵
- Adds Run key to start application
-
C:\ProgramData\Intel.exeC:\ProgramData\Intel.exe2⤵
- Executes dropped EXE
- Drops startup file
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Intel.exe"C:\ProgramData\Intel.exe"3⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7923⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
C:\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
C:\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
memory/332-61-0x0000000000000000-mapping.dmp
-
memory/332-80-0x0000000074500000-0x0000000074AAB000-memory.dmpFilesize
5.7MB
-
memory/332-79-0x0000000074500000-0x0000000074AAB000-memory.dmpFilesize
5.7MB
-
memory/1212-73-0x0000000000401F8F-mapping.dmp
-
memory/1212-66-0x0000000000070000-0x0000000000087000-memory.dmpFilesize
92KB
-
memory/1212-67-0x0000000000070000-0x0000000000087000-memory.dmpFilesize
92KB
-
memory/1212-71-0x0000000000070000-0x0000000000087000-memory.dmpFilesize
92KB
-
memory/1212-69-0x0000000000070000-0x0000000000087000-memory.dmpFilesize
92KB
-
memory/1212-75-0x0000000000070000-0x0000000000087000-memory.dmpFilesize
92KB
-
memory/1224-65-0x0000000074500000-0x0000000074AAB000-memory.dmpFilesize
5.7MB
-
memory/1224-55-0x0000000074500000-0x0000000074AAB000-memory.dmpFilesize
5.7MB
-
memory/1224-56-0x0000000074500000-0x0000000074AAB000-memory.dmpFilesize
5.7MB
-
memory/1224-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/1500-57-0x0000000000000000-mapping.dmp
-
memory/1740-76-0x0000000000000000-mapping.dmp
-
memory/1784-58-0x0000000000000000-mapping.dmp