Analysis
-
max time kernel
169s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:37
Static task
static1
Behavioral task
behavioral1
Sample
f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe
Resource
win10v2004-20220812-en
General
-
Target
f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe
-
Size
192KB
-
MD5
f8b629eee798245f18f2b7415642993a
-
SHA1
3853e76f713d1274f6e897b4957a74bd9fcfd98e
-
SHA256
f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3
-
SHA512
eba6df3594fa71d806d0910fc740371fb0223cd200344315e2cc0a109db01abfc223a3053a57c9651ff0eadb3fbac66f39de6a5a9e1d231a0f2fd342816549fe
-
SSDEEP
3072:kAoU1Bieu+xxf0pTraRV5uH/QJillUd2KltjGSVVfKmw9y:1in+oTCG/z62+9+y
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
winlog.exewinlog.exepid process 1212 winlog.exe 1136 winlog.exe -
Loads dropped DLL 2 IoCs
Processes:
f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exepid process 1696 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe 1696 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winlog.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlog.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\winlog.exe" winlog.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
winlog.exedescription ioc process File opened (read-only) \??\F: winlog.exe File opened (read-only) \??\K: winlog.exe File opened (read-only) \??\M: winlog.exe File opened (read-only) \??\N: winlog.exe File opened (read-only) \??\X: winlog.exe File opened (read-only) \??\G: winlog.exe File opened (read-only) \??\H: winlog.exe File opened (read-only) \??\I: winlog.exe File opened (read-only) \??\T: winlog.exe File opened (read-only) \??\Y: winlog.exe File opened (read-only) \??\S: winlog.exe File opened (read-only) \??\V: winlog.exe File opened (read-only) \??\Z: winlog.exe File opened (read-only) \??\J: winlog.exe File opened (read-only) \??\L: winlog.exe File opened (read-only) \??\O: winlog.exe File opened (read-only) \??\P: winlog.exe File opened (read-only) \??\R: winlog.exe File opened (read-only) \??\E: winlog.exe File opened (read-only) \??\Q: winlog.exe File opened (read-only) \??\U: winlog.exe File opened (read-only) \??\W: winlog.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exewinlog.exedescription pid process target process PID 1996 set thread context of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1212 set thread context of 1136 1212 winlog.exe winlog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exef242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exewinlog.exedescription pid process target process PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1996 wrote to memory of 1696 1996 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe PID 1696 wrote to memory of 1212 1696 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe winlog.exe PID 1696 wrote to memory of 1212 1696 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe winlog.exe PID 1696 wrote to memory of 1212 1696 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe winlog.exe PID 1696 wrote to memory of 1212 1696 f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe PID 1212 wrote to memory of 1136 1212 winlog.exe winlog.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe"C:\Users\Admin\AppData\Local\Temp\f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exeC:\Users\Admin\AppData\Local\Temp\f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exeC:\Users\Admin\AppData\Roaming\Microsoft\winlog.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exeFilesize
192KB
MD5f8b629eee798245f18f2b7415642993a
SHA13853e76f713d1274f6e897b4957a74bd9fcfd98e
SHA256f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3
SHA512eba6df3594fa71d806d0910fc740371fb0223cd200344315e2cc0a109db01abfc223a3053a57c9651ff0eadb3fbac66f39de6a5a9e1d231a0f2fd342816549fe
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exeFilesize
192KB
MD5f8b629eee798245f18f2b7415642993a
SHA13853e76f713d1274f6e897b4957a74bd9fcfd98e
SHA256f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3
SHA512eba6df3594fa71d806d0910fc740371fb0223cd200344315e2cc0a109db01abfc223a3053a57c9651ff0eadb3fbac66f39de6a5a9e1d231a0f2fd342816549fe
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exeFilesize
192KB
MD5f8b629eee798245f18f2b7415642993a
SHA13853e76f713d1274f6e897b4957a74bd9fcfd98e
SHA256f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3
SHA512eba6df3594fa71d806d0910fc740371fb0223cd200344315e2cc0a109db01abfc223a3053a57c9651ff0eadb3fbac66f39de6a5a9e1d231a0f2fd342816549fe
-
\Users\Admin\AppData\Roaming\Microsoft\winlog.exeFilesize
192KB
MD5f8b629eee798245f18f2b7415642993a
SHA13853e76f713d1274f6e897b4957a74bd9fcfd98e
SHA256f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3
SHA512eba6df3594fa71d806d0910fc740371fb0223cd200344315e2cc0a109db01abfc223a3053a57c9651ff0eadb3fbac66f39de6a5a9e1d231a0f2fd342816549fe
-
\Users\Admin\AppData\Roaming\Microsoft\winlog.exeFilesize
192KB
MD5f8b629eee798245f18f2b7415642993a
SHA13853e76f713d1274f6e897b4957a74bd9fcfd98e
SHA256f242374e518229643caa67f314f06c47ed5d1ba6287a2168ac6f84b2578fdbb3
SHA512eba6df3594fa71d806d0910fc740371fb0223cd200344315e2cc0a109db01abfc223a3053a57c9651ff0eadb3fbac66f39de6a5a9e1d231a0f2fd342816549fe
-
memory/1136-66-0x00000000114AE184-mapping.dmp
-
memory/1136-70-0x0000000011490000-0x00000000114BA000-memory.dmpFilesize
168KB
-
memory/1136-71-0x0000000011490000-0x00000000114BA000-memory.dmpFilesize
168KB
-
memory/1136-72-0x0000000011490000-0x00000000114BA000-memory.dmpFilesize
168KB
-
memory/1212-62-0x0000000000000000-mapping.dmp
-
memory/1696-59-0x0000000011490000-0x00000000114BA000-memory.dmpFilesize
168KB
-
memory/1696-58-0x0000000011490000-0x00000000114BA000-memory.dmpFilesize
168KB
-
memory/1696-54-0x0000000011490000-0x00000000114BA000-memory.dmpFilesize
168KB
-
memory/1696-57-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1696-56-0x0000000011490000-0x00000000114BA000-memory.dmpFilesize
168KB
-
memory/1696-55-0x00000000114AE184-mapping.dmp