Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:23
Static task
static1
Behavioral task
behavioral1
Sample
8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe
Resource
win10v2004-20220901-en
General
-
Target
8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe
-
Size
204KB
-
MD5
b704a8917354ea328439ab277695c988
-
SHA1
363b180aa6848b1769ee9727d0a567a4204d0dd8
-
SHA256
8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772
-
SHA512
cc805e50fd2ebdb563f3d75897798062e6733ad62ce23ce21f966595cc4b64bfcbcf192939c2794f6d308c02e8f8bacdc375e0dea4a17fd176b6f49128b7d5af
-
SSDEEP
6144:4XHdo4n52x9lLdVa28IgSQ51VRx4hvd/:4X43VaR/nx2N
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
LocalEPspsyUWCG.exechrome.exepid process 1892 LocalEPspsyUWCG.exe 1988 chrome.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d5a38e9b5f206c41f8851bf04a251d26.exe chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d5a38e9b5f206c41f8851bf04a251d26.exe chrome.exe -
Loads dropped DLL 1 IoCs
Processes:
LocalEPspsyUWCG.exepid process 1892 LocalEPspsyUWCG.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\d5a38e9b5f206c41f8851bf04a251d26 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\d5a38e9b5f206c41f8851bf04a251d26 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
chrome.exepid process 1988 chrome.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
chrome.exedescription pid process Token: SeDebugPrivilege 1988 chrome.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exeLocalEPspsyUWCG.exechrome.exedescription pid process target process PID 1056 wrote to memory of 1892 1056 8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe LocalEPspsyUWCG.exe PID 1056 wrote to memory of 1892 1056 8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe LocalEPspsyUWCG.exe PID 1056 wrote to memory of 1892 1056 8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe LocalEPspsyUWCG.exe PID 1056 wrote to memory of 1892 1056 8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe LocalEPspsyUWCG.exe PID 1892 wrote to memory of 1988 1892 LocalEPspsyUWCG.exe chrome.exe PID 1892 wrote to memory of 1988 1892 LocalEPspsyUWCG.exe chrome.exe PID 1892 wrote to memory of 1988 1892 LocalEPspsyUWCG.exe chrome.exe PID 1892 wrote to memory of 1988 1892 LocalEPspsyUWCG.exe chrome.exe PID 1988 wrote to memory of 456 1988 chrome.exe netsh.exe PID 1988 wrote to memory of 456 1988 chrome.exe netsh.exe PID 1988 wrote to memory of 456 1988 chrome.exe netsh.exe PID 1988 wrote to memory of 456 1988 chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe"C:\Users\Admin\AppData\Local\Temp\8fe298ced61542daafc4b97db08c385d49bf4ead7e342775f5e7e59c75beb772.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\LocalEPspsyUWCG.exe"C:\Users\Admin\AppData\LocalEPspsyUWCG.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome.exe" "chrome.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalEPspsyUWCG.exeFilesize
43KB
MD5bc0b928a9140ae12a79516dc6d74e39b
SHA16b0f881cd0410ff45a463fca6b472f1e53de1413
SHA2568cd341d4b05a5998647d6ae6c9f87707701021300860b10af26241e2ed65f0bd
SHA512249f3607fb8a3156c741f21f159243174797bdd98a6db6a40790d177c26ff4846c66bbf64970008f1cd68afb769cc34c54fb3295fbdb18702248a91f08ec998d
-
C:\Users\Admin\AppData\LocalEPspsyUWCG.exeFilesize
43KB
MD5bc0b928a9140ae12a79516dc6d74e39b
SHA16b0f881cd0410ff45a463fca6b472f1e53de1413
SHA2568cd341d4b05a5998647d6ae6c9f87707701021300860b10af26241e2ed65f0bd
SHA512249f3607fb8a3156c741f21f159243174797bdd98a6db6a40790d177c26ff4846c66bbf64970008f1cd68afb769cc34c54fb3295fbdb18702248a91f08ec998d
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
43KB
MD5bc0b928a9140ae12a79516dc6d74e39b
SHA16b0f881cd0410ff45a463fca6b472f1e53de1413
SHA2568cd341d4b05a5998647d6ae6c9f87707701021300860b10af26241e2ed65f0bd
SHA512249f3607fb8a3156c741f21f159243174797bdd98a6db6a40790d177c26ff4846c66bbf64970008f1cd68afb769cc34c54fb3295fbdb18702248a91f08ec998d
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
43KB
MD5bc0b928a9140ae12a79516dc6d74e39b
SHA16b0f881cd0410ff45a463fca6b472f1e53de1413
SHA2568cd341d4b05a5998647d6ae6c9f87707701021300860b10af26241e2ed65f0bd
SHA512249f3607fb8a3156c741f21f159243174797bdd98a6db6a40790d177c26ff4846c66bbf64970008f1cd68afb769cc34c54fb3295fbdb18702248a91f08ec998d
-
\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
43KB
MD5bc0b928a9140ae12a79516dc6d74e39b
SHA16b0f881cd0410ff45a463fca6b472f1e53de1413
SHA2568cd341d4b05a5998647d6ae6c9f87707701021300860b10af26241e2ed65f0bd
SHA512249f3607fb8a3156c741f21f159243174797bdd98a6db6a40790d177c26ff4846c66bbf64970008f1cd68afb769cc34c54fb3295fbdb18702248a91f08ec998d
-
memory/456-67-0x0000000000000000-mapping.dmp
-
memory/1056-59-0x0000000002000000-0x0000000002010000-memory.dmpFilesize
64KB
-
memory/1056-54-0x000007FEF48A0000-0x000007FEF52C3000-memory.dmpFilesize
10.1MB
-
memory/1056-55-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmpFilesize
8KB
-
memory/1892-60-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/1892-61-0x0000000074D40000-0x00000000752EB000-memory.dmpFilesize
5.7MB
-
memory/1892-56-0x0000000000000000-mapping.dmp
-
memory/1892-68-0x0000000074D40000-0x00000000752EB000-memory.dmpFilesize
5.7MB
-
memory/1988-63-0x0000000000000000-mapping.dmp
-
memory/1988-70-0x0000000074D40000-0x00000000752EB000-memory.dmpFilesize
5.7MB
-
memory/1988-71-0x0000000074D40000-0x00000000752EB000-memory.dmpFilesize
5.7MB