Analysis
-
max time kernel
170s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 09:38
Static task
static1
Behavioral task
behavioral1
Sample
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe
Resource
win10v2004-20220901-en
General
-
Target
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe
-
Size
172KB
-
MD5
dafc043be699b11f059f25d3df8360d0
-
SHA1
973a61daf7a94734fb1c8244b66042658f2642ce
-
SHA256
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39
-
SHA512
6e69e2488f170d9c453e8a41ce1a53ec372d097b1587c7c4351fc1b04fd1852e8ac23cfbfb11b02fd6627d2b67975b56450bc3f07058ee2c78b1e2b182eec9e2
-
SSDEEP
3072:P6oBRcjQ0GCmBrGltChf8jytCeJxyYVCK+mQEryy:P61mBrGbywejyjKpOy
Malware Config
Extracted
tofsee
111.121.193.238
202.146.217.143
188.190.113.149
188.165.132.183
213.155.0.208
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
cupfpshw.execupfpshw.exepid process 520 cupfpshw.exe 1512 cupfpshw.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1336 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exepid process 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\cupfpshw.exe\"" 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.execupfpshw.execupfpshw.exedescription pid process target process PID 1480 set thread context of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 520 set thread context of 1512 520 cupfpshw.exe cupfpshw.exe PID 1512 set thread context of 1720 1512 cupfpshw.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.execupfpshw.exepid process 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 520 cupfpshw.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.execupfpshw.execupfpshw.exedescription pid process target process PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1480 wrote to memory of 1372 1480 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe PID 1372 wrote to memory of 520 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe cupfpshw.exe PID 1372 wrote to memory of 520 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe cupfpshw.exe PID 1372 wrote to memory of 520 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe cupfpshw.exe PID 1372 wrote to memory of 520 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe cupfpshw.exe PID 1372 wrote to memory of 1336 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe cmd.exe PID 1372 wrote to memory of 1336 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe cmd.exe PID 1372 wrote to memory of 1336 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe cmd.exe PID 1372 wrote to memory of 1336 1372 2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe cmd.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 520 wrote to memory of 1512 520 cupfpshw.exe cupfpshw.exe PID 1512 wrote to memory of 1720 1512 cupfpshw.exe svchost.exe PID 1512 wrote to memory of 1720 1512 cupfpshw.exe svchost.exe PID 1512 wrote to memory of 1720 1512 cupfpshw.exe svchost.exe PID 1512 wrote to memory of 1720 1512 cupfpshw.exe svchost.exe PID 1512 wrote to memory of 1720 1512 cupfpshw.exe svchost.exe PID 1512 wrote to memory of 1720 1512 cupfpshw.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe"C:\Users\Admin\AppData\Local\Temp\2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe"C:\Users\Admin\AppData\Local\Temp\2cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\cupfpshw.exe"C:\Users\Admin\cupfpshw.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\cupfpshw.exe"C:\Users\Admin\cupfpshw.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6878.bat" "3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6878.batFilesize
302B
MD51158f227597a327b8c0d24d1c310703e
SHA18916d2f13f90d32d184b42193104608d7a4354b7
SHA256a2db3ba8e66d004f0c1102d2a00cabc941aec32bd3b74f24aceea1e6a0b71e7e
SHA512b1a4e0bef4d3cbee0644e687ffdd6f321efdcf6a00b0265ca868425bfdaa6d4dfbc4b9b5cb94ac05eaf962aff30555b1e08082e3d223bd73d769e48b9d17af67
-
C:\Users\Admin\cupfpshw.exeFilesize
172KB
MD5dafc043be699b11f059f25d3df8360d0
SHA1973a61daf7a94734fb1c8244b66042658f2642ce
SHA2562cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39
SHA5126e69e2488f170d9c453e8a41ce1a53ec372d097b1587c7c4351fc1b04fd1852e8ac23cfbfb11b02fd6627d2b67975b56450bc3f07058ee2c78b1e2b182eec9e2
-
C:\Users\Admin\cupfpshw.exeFilesize
172KB
MD5dafc043be699b11f059f25d3df8360d0
SHA1973a61daf7a94734fb1c8244b66042658f2642ce
SHA2562cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39
SHA5126e69e2488f170d9c453e8a41ce1a53ec372d097b1587c7c4351fc1b04fd1852e8ac23cfbfb11b02fd6627d2b67975b56450bc3f07058ee2c78b1e2b182eec9e2
-
C:\Users\Admin\cupfpshw.exeFilesize
172KB
MD5dafc043be699b11f059f25d3df8360d0
SHA1973a61daf7a94734fb1c8244b66042658f2642ce
SHA2562cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39
SHA5126e69e2488f170d9c453e8a41ce1a53ec372d097b1587c7c4351fc1b04fd1852e8ac23cfbfb11b02fd6627d2b67975b56450bc3f07058ee2c78b1e2b182eec9e2
-
\Users\Admin\cupfpshw.exeFilesize
172KB
MD5dafc043be699b11f059f25d3df8360d0
SHA1973a61daf7a94734fb1c8244b66042658f2642ce
SHA2562cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39
SHA5126e69e2488f170d9c453e8a41ce1a53ec372d097b1587c7c4351fc1b04fd1852e8ac23cfbfb11b02fd6627d2b67975b56450bc3f07058ee2c78b1e2b182eec9e2
-
\Users\Admin\cupfpshw.exeFilesize
172KB
MD5dafc043be699b11f059f25d3df8360d0
SHA1973a61daf7a94734fb1c8244b66042658f2642ce
SHA2562cb8331dab2c0c108691947e56b4172716b1d23fd064a932d6202f7cf76feb39
SHA5126e69e2488f170d9c453e8a41ce1a53ec372d097b1587c7c4351fc1b04fd1852e8ac23cfbfb11b02fd6627d2b67975b56450bc3f07058ee2c78b1e2b182eec9e2
-
memory/520-63-0x0000000000000000-mapping.dmp
-
memory/1336-68-0x0000000000000000-mapping.dmp
-
memory/1372-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-57-0x000000000040782C-mapping.dmp
-
memory/1372-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-59-0x0000000076261000-0x0000000076263000-memory.dmpFilesize
8KB
-
memory/1512-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1512-72-0x000000000040782C-mapping.dmp
-
memory/1512-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1512-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1720-78-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1720-80-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1720-85-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1720-81-0x000000000008782C-mapping.dmp
-
memory/1720-86-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1720-87-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB