Analysis
-
max time kernel
24s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 13:56
Static task
static1
Behavioral task
behavioral1
Sample
14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe
Resource
win10v2004-20220812-en
General
-
Target
14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe
-
Size
102KB
-
MD5
58bc14cd9a5b15b3d7926f857484042f
-
SHA1
77e0eaf796306feb74a474703526f6ab1ab7ed4d
-
SHA256
14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e
-
SHA512
7ba79d436c56ecc0e19583feb304e46ad79218126cd5881676ebb79c2dbf283ce0ab7a93eb272eff6db2e69f524697f334a7f637afed6b2b93126ae2a870817b
-
SSDEEP
1536:9QxqcQu0XPmEmEcYUpEjCTfaAIW1EvqTlrxtPpFAXF9N/6Sy:y/03mEcppEjCTfaAIWSqTlrbPLEz4
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
6ty2EEE.exe6ty2EEE.exepid process 1492 6ty2EEE.exe 1756 6ty2EEE.exe -
Loads dropped DLL 8 IoCs
Processes:
14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe6ty2EEE.exeWerFault.exepid process 748 14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe 748 14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe 1492 6ty2EEE.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6ty2EEE.exedescription pid process target process PID 1492 set thread context of 1756 1492 6ty2EEE.exe 6ty2EEE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1468 1756 WerFault.exe 6ty2EEE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1784 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
6ty2EEE.exepid process 1492 6ty2EEE.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe6ty2EEE.exe6ty2EEE.exedescription pid process target process PID 748 wrote to memory of 1492 748 14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe 6ty2EEE.exe PID 748 wrote to memory of 1492 748 14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe 6ty2EEE.exe PID 748 wrote to memory of 1492 748 14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe 6ty2EEE.exe PID 748 wrote to memory of 1492 748 14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1492 wrote to memory of 1756 1492 6ty2EEE.exe 6ty2EEE.exe PID 1756 wrote to memory of 1468 1756 6ty2EEE.exe WerFault.exe PID 1756 wrote to memory of 1468 1756 6ty2EEE.exe WerFault.exe PID 1756 wrote to memory of 1468 1756 6ty2EEE.exe WerFault.exe PID 1756 wrote to memory of 1468 1756 6ty2EEE.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe"C:\Users\Admin\AppData\Local\Temp\14198d89ceab423eac364fc5bf110eaa5fa9d283a872ef622909065d267a8a9e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6ty2EEE.exe"C:\Users\Admin\AppData\Local\Temp\6ty2EEE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6ty2EEE.exe"C:\Users\Admin\AppData\Local\Temp\6ty2EEE.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 964⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
C:\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
C:\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
C:\Users\Admin\AppData\Local\Temp\6ty3056.jpgFilesize
3KB
MD5d101d07ba61bc6990aac73a0cdd67f4f
SHA1aff942e16e1e952f57cd7e51dc3219f7f7812390
SHA2565b01fe09d445ec0e38b1db3443dd7013bfc2b871fae69a5c0e978fc58b560c05
SHA5129cb17efd8bb5c870ebf7c70870a803a8d7f775596d86165ea2dff0d42f1fa775eef407cd333ee91f866c64074fb82f3e19a1c93a56114a8fc2967e72e88f285b
-
\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
\Users\Admin\AppData\Local\Temp\6ty2EEE.exeFilesize
74KB
MD55b1a85d948bd7a075ebd0df2296ae9d5
SHA12b7cab4c68ca6c0fa28b360f9eb4673e7b075a24
SHA2568cfb09392dd6cf7042c9aa9c98fbc9ef5969441d9cbf9d142fd5cbb9d70cd121
SHA51246f05ba3117297faab0a7279d0791fd2e1daebcf9dbcbffaa17c2ee34ac3a68b4b8a40d4d73431a9da7e4a4c293aaf7a9f4bde2d4c93aa4f883c57fb6b2c0575
-
memory/748-54-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1468-81-0x0000000000000000-mapping.dmp
-
memory/1492-57-0x0000000000000000-mapping.dmp
-
memory/1756-76-0x00000000004102A0-mapping.dmp
-
memory/1756-78-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1756-79-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1756-80-0x0000000000410000-0x0000000000412000-memory.dmpFilesize
8KB
-
memory/1756-74-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1756-72-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1756-67-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1756-69-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1756-65-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1756-64-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1756-87-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB