Analysis
- max time kernel
203s - max time network
201s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system - submitted
24/11/2022, 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe
Resource
win7-20221111-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe
- Size 277KB
- Sample221124-ftb6wabb52
- SHA256 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6
- MD5 53cda9ef44c8efa08900b21c569f2f99
- SHA1 a557562aa8c06cea50176e4f22cfe3c652441873
- SHA512 94cfa19730e5341a494dee44bfe313eb8bed6f620a62ae99d54672c4da045632a2778d65a7aa9d4f9c5488a975a903515b049fb8eaac5ab277868745ea721044
- SSDEEP 6144:5wHysfSJnooGdv/ho0de97vfH7KSOTDr0cVEobKuahuHJLZ:Cqyokv5m73zOTH0cVEYKuHlZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{3F97F137-7DE1-4A6A-AE48-FCC9733A43F7}\\f5ea51da.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{3F97F137-7DE1-4A6A-AE48-FCC9733A43F7}\\f5ea51da.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2020 set thread context of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1204 Process not Found - Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 728 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 728 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeDebugPrivilege 1276 explorer.exe Token: SeAssignPrimaryTokenPrivilege 860 Process not Found Token: SeIncreaseQuotaPrivilege 860 Process not Found Token: SeSecurityPrivilege 860 Process not Found Token: SeTakeOwnershipPrivilege 860 Process not Found Token: SeLoadDriverPrivilege 860 Process not Found Token: SeRestorePrivilege 860 Process not Found Token: SeSystemEnvironmentPrivilege 860 Process not Found Token: SeAssignPrimaryTokenPrivilege 860 Process not Found Token: SeIncreaseQuotaPrivilege 860 Process not Found Token: SeSecurityPrivilege 860 Process not Found Token: SeTakeOwnershipPrivilege 860 Process not Found Token: SeLoadDriverPrivilege 860 Process not Found Token: SeSystemtimePrivilege 860 Process not Found Token: SeBackupPrivilege 860 Process not Found Token: SeRestorePrivilege 860 Process not Found Token: SeShutdownPrivilege 860 Process not Found Token: SeSystemEnvironmentPrivilege 860 Process not Found Token: SeUndockPrivilege 860 Process not Found Token: SeManageVolumePrivilege 860 Process not Found Token: SeAssignPrimaryTokenPrivilege 860 Process not Found Token: SeIncreaseQuotaPrivilege 860 Process not Found Token: SeSecurityPrivilege 860 Process not Found Token: SeTakeOwnershipPrivilege 860 Process not Found Token: SeLoadDriverPrivilege 860 Process not Found Token: SeRestorePrivilege 860 Process not Found Token: SeSystemEnvironmentPrivilege 860 Process not Found Token: SeAssignPrimaryTokenPrivilege 860 Process not Found Token: SeIncreaseQuotaPrivilege 860 Process not Found Token: SeSecurityPrivilege 860 Process not Found Token: SeTakeOwnershipPrivilege 860 Process not Found Token: SeLoadDriverPrivilege 860 Process not Found Token: SeRestorePrivilege 860 Process not Found Token: SeSystemEnvironmentPrivilege 860 Process not Found Token: SeAssignPrimaryTokenPrivilege 860 Process not Found Token: SeIncreaseQuotaPrivilege 860 Process not Found Token: SeSecurityPrivilege 860 Process not Found Token: SeTakeOwnershipPrivilege 860 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1204 Process not Found 1204 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1204 Process not Found 1204 Process not Found - Suspicious use of UnmapMainImage 8 IoCs
pid Process 792 Process not Found 792 Process not Found 792 Process not Found 792 Process not Found 792 Process not Found 792 Process not Found 1204 Process not Found 1204 Process not Found - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 2020 wrote to memory of 728 2020 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 28 PID 728 wrote to memory of 1276 728 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 29 PID 728 wrote to memory of 1276 728 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 29 PID 728 wrote to memory of 1276 728 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 29 PID 728 wrote to memory of 1276 728 0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe"C:\Users\Admin\AppData\Local\Temp\0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe"C:\Users\Admin\AppData\Local\Temp\0edabe7722359593c261ce992bcf2c8decb8df7b35e538d328f5d5e15b283cd6.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Users\Admin\AppData\Local\Temp\nsoEC73.tmp\coquille.dll
- Size 14KB
- SHA256 6b34d5c64fb635fe2dc5fbbe61c30eae196d389fa107ca11a9efb0bf377c2c77
- MD5 8da8ca180453926a6ff3e3008421b8a2
- SHA1 3aa994c4a56e67bbb8d6f7c2bb5a4c42156d3870
- SHA512 f29a2ede38df080b831420eecb68a933ba8caa054809d4f8fb698078d107c28f5b95e2e62b341d10b83f9b8d010c0d7622440d1c74b13aca486b8daf5eecdd01
- SSDEEP 192:EHUDjkUmGne1vVmrJNLFpt+2ltua29cPEMstqNpVdhX0rPwujWs:UuIIPLFpnJq/tqNzPTuj
- MD5 SHA1 SHA512 SSDEEP