Analysis
-
max time kernel
174s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:47
Static task
static1
Behavioral task
behavioral1
Sample
f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe
Resource
win10v2004-20221111-en
General
-
Target
f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe
-
Size
1.2MB
-
MD5
a2aad753587a08feeb95e997e0b50b06
-
SHA1
44e7398af49003fa3d8632519af7910360f9bb93
-
SHA256
f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8
-
SHA512
4283eb55e555019e0b6bc8bb6399080a780c648fb02a9778435d2b4fc8eb8369aea291cc36940aad4a3e322af9b87152adc0c297d98e011dc85077709419b96d
-
SSDEEP
24576:w32K9nTaIi6fKcs2RDCZ3uBs0Sb9m3n7IWOZp46aE9RAW:w3MIimKZ8mBuBs0S58nbOZ1aE9O
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cpuid.exepid process 1604 cpuid.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\cpuid.exe upx \Users\Admin\AppData\Roaming\cpuid.exe upx behavioral1/memory/1604-76-0x0000000000400000-0x00000000004C1000-memory.dmp upx C:\Users\Admin\AppData\Roaming\cpuid.exe upx behavioral1/memory/1604-81-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/1604-82-0x0000000000400000-0x00000000004C1000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 268 vbc.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\"" f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1604-81-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral1/memory/1604-82-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exedescription pid process target process PID 944 set thread context of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
cpuid.exepid process 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
cpuid.exepid process 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe 1604 cpuid.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exevbc.execpuid.exedescription pid process target process PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 944 wrote to memory of 268 944 f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe vbc.exe PID 268 wrote to memory of 1604 268 vbc.exe cpuid.exe PID 268 wrote to memory of 1604 268 vbc.exe cpuid.exe PID 268 wrote to memory of 1604 268 vbc.exe cpuid.exe PID 268 wrote to memory of 1604 268 vbc.exe cpuid.exe PID 1604 wrote to memory of 1964 1604 cpuid.exe cmd.exe PID 1604 wrote to memory of 1964 1604 cpuid.exe cmd.exe PID 1604 wrote to memory of 1964 1604 cpuid.exe cmd.exe PID 1604 wrote to memory of 1964 1604 cpuid.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe"C:\Users\Admin\AppData\Local\Temp\f2bd8dad0865697b7422f3ef00bd860c3616e8080dbf12c7e6b0e5828cebf0d8.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cpuid.exe"C:\Users\Admin\AppData\Roaming\cpuid.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /s /a "C:\Users\Admin\AppData\Roaming\*.dat"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\cpuid.exeFilesize
376KB
MD53f941c126d0b8babc471e0e91c49a5bf
SHA16f7b63fbdf1bd596a4c87c04a023b6ab75c8b1d7
SHA256357aeae30cfdc314f327d40f9be6e95a7b6bdb2688fe8fc0102a8a19c88c5af8
SHA512ee09f0b1d43055714cd209141454114e190b0e36f16aeeb0b2368f7ff7bb9f6cdaf7b963e57059182121b530dd9f56bfd9077b83cddb522f04e5802ea6045a72
-
C:\Users\Admin\AppData\Roaming\cpuid.exeFilesize
376KB
MD53f941c126d0b8babc471e0e91c49a5bf
SHA16f7b63fbdf1bd596a4c87c04a023b6ab75c8b1d7
SHA256357aeae30cfdc314f327d40f9be6e95a7b6bdb2688fe8fc0102a8a19c88c5af8
SHA512ee09f0b1d43055714cd209141454114e190b0e36f16aeeb0b2368f7ff7bb9f6cdaf7b963e57059182121b530dd9f56bfd9077b83cddb522f04e5802ea6045a72
-
\Users\Admin\AppData\Roaming\cpuid.exeFilesize
376KB
MD53f941c126d0b8babc471e0e91c49a5bf
SHA16f7b63fbdf1bd596a4c87c04a023b6ab75c8b1d7
SHA256357aeae30cfdc314f327d40f9be6e95a7b6bdb2688fe8fc0102a8a19c88c5af8
SHA512ee09f0b1d43055714cd209141454114e190b0e36f16aeeb0b2368f7ff7bb9f6cdaf7b963e57059182121b530dd9f56bfd9077b83cddb522f04e5802ea6045a72
-
memory/268-75-0x0000000002800000-0x00000000028C1000-memory.dmpFilesize
772KB
-
memory/268-57-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/268-61-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/268-63-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/268-65-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/268-66-0x0000000000441175-mapping.dmp
-
memory/268-69-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/268-79-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/268-71-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/268-59-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/268-56-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/944-55-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/944-54-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/944-70-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/1604-73-0x0000000000000000-mapping.dmp
-
memory/1604-76-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1604-81-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1604-82-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1964-80-0x0000000000000000-mapping.dmp