Analysis
-
max time kernel
50s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 16:46
Static task
static1
Behavioral task
behavioral1
Sample
f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe
Resource
win10v2004-20220812-en
General
-
Target
f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe
-
Size
369KB
-
MD5
d86ef322a661d37130f5a4d0effd03f3
-
SHA1
f75cfb7790bb6d554fdf436ac941fb786a78082d
-
SHA256
f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d
-
SHA512
f86724453a3680a44523914609d114cf8fb7b1475ac3e00e465034f3e12a230e7c81f9d90854475bbeeedb0dd2fc0af9f00732edb9f0789c0b3a827b03b20dab
-
SSDEEP
6144:J9PpMQZm7dznwijvPEaabsuI1FKiswVO2yqrBncky:JPMQZm7dznwijvPEaac1FKJx2JSky
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32.exepid process 936 rundll32.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ca9c409cae049493b77941d19805dd5.exe rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ca9c409cae049493b77941d19805dd5.exe rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exedw20.exepid process 1968 f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe 1756 dw20.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0ca9c409cae049493b77941d19805dd5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe\" .." rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\0ca9c409cae049493b77941d19805dd5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe\" .." rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exerundll32.exedescription pid process target process PID 1968 wrote to memory of 936 1968 f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe rundll32.exe PID 1968 wrote to memory of 936 1968 f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe rundll32.exe PID 1968 wrote to memory of 936 1968 f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe rundll32.exe PID 1968 wrote to memory of 936 1968 f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe rundll32.exe PID 1968 wrote to memory of 936 1968 f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe rundll32.exe PID 1968 wrote to memory of 936 1968 f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe rundll32.exe PID 1968 wrote to memory of 936 1968 f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe rundll32.exe PID 936 wrote to memory of 1716 936 rundll32.exe netsh.exe PID 936 wrote to memory of 1716 936 rundll32.exe netsh.exe PID 936 wrote to memory of 1716 936 rundll32.exe netsh.exe PID 936 wrote to memory of 1716 936 rundll32.exe netsh.exe PID 936 wrote to memory of 1756 936 rundll32.exe dw20.exe PID 936 wrote to memory of 1756 936 rundll32.exe dw20.exe PID 936 wrote to memory of 1756 936 rundll32.exe dw20.exe PID 936 wrote to memory of 1756 936 rundll32.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe"C:\Users\Admin\AppData\Local\Temp\f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rundll32.exe"C:\Users\Admin\AppData\Local\Temp\rundll32.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\rundll32.exe" "rundll32.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5163⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rundll32.exeFilesize
369KB
MD5d86ef322a661d37130f5a4d0effd03f3
SHA1f75cfb7790bb6d554fdf436ac941fb786a78082d
SHA256f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d
SHA512f86724453a3680a44523914609d114cf8fb7b1475ac3e00e465034f3e12a230e7c81f9d90854475bbeeedb0dd2fc0af9f00732edb9f0789c0b3a827b03b20dab
-
C:\Users\Admin\AppData\Local\Temp\rundll32.exeFilesize
369KB
MD5d86ef322a661d37130f5a4d0effd03f3
SHA1f75cfb7790bb6d554fdf436ac941fb786a78082d
SHA256f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d
SHA512f86724453a3680a44523914609d114cf8fb7b1475ac3e00e465034f3e12a230e7c81f9d90854475bbeeedb0dd2fc0af9f00732edb9f0789c0b3a827b03b20dab
-
\Users\Admin\AppData\Local\Temp\rundll32.exeFilesize
369KB
MD5d86ef322a661d37130f5a4d0effd03f3
SHA1f75cfb7790bb6d554fdf436ac941fb786a78082d
SHA256f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d
SHA512f86724453a3680a44523914609d114cf8fb7b1475ac3e00e465034f3e12a230e7c81f9d90854475bbeeedb0dd2fc0af9f00732edb9f0789c0b3a827b03b20dab
-
\Users\Admin\AppData\Local\Temp\rundll32.exeFilesize
369KB
MD5d86ef322a661d37130f5a4d0effd03f3
SHA1f75cfb7790bb6d554fdf436ac941fb786a78082d
SHA256f7f53052b36f373a7650e9e1ac8a29ed38ac614cc24d6b7b5fb27d3da646570d
SHA512f86724453a3680a44523914609d114cf8fb7b1475ac3e00e465034f3e12a230e7c81f9d90854475bbeeedb0dd2fc0af9f00732edb9f0789c0b3a827b03b20dab
-
memory/936-57-0x0000000000000000-mapping.dmp
-
memory/936-62-0x0000000073E20000-0x00000000743CB000-memory.dmpFilesize
5.7MB
-
memory/936-65-0x0000000073E20000-0x00000000743CB000-memory.dmpFilesize
5.7MB
-
memory/1716-63-0x0000000000000000-mapping.dmp
-
memory/1756-66-0x0000000000000000-mapping.dmp
-
memory/1968-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmpFilesize
8KB
-
memory/1968-55-0x0000000073E20000-0x00000000743CB000-memory.dmpFilesize
5.7MB
-
memory/1968-61-0x0000000073E20000-0x00000000743CB000-memory.dmpFilesize
5.7MB