Analysis
-
max time kernel
29s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:47
Static task
static1
Behavioral task
behavioral1
Sample
e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe
Resource
win10v2004-20220812-en
General
-
Target
e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe
-
Size
1.5MB
-
MD5
e84676bb6ff9435b81e3f49e262de91d
-
SHA1
3eca53eafb62cb4c6afb6fde9fd2519a87fec393
-
SHA256
e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13
-
SHA512
3017c3305e45e2b20372753d2683bcb201acf46a86c037f326b48cb016c450ec9998474e70697faaeb0a1df09655a980a2455854c62871a14f3106a073ee19f3
-
SSDEEP
24576:Hpa/O74CNt3r2J2FC3eUldZUJ3OlKU4UDcc6Cy+9eG:wcZC35VcOcmDcc6Cd
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exedescription pid process target process PID 1956 set thread context of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exepid process 572 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe 572 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe 572 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe 572 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe 572 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.execmd.exedescription pid process target process PID 1956 wrote to memory of 1712 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe cmd.exe PID 1956 wrote to memory of 1712 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe cmd.exe PID 1956 wrote to memory of 1712 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe cmd.exe PID 1956 wrote to memory of 1712 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe cmd.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1712 wrote to memory of 1164 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1164 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1164 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1164 1712 cmd.exe PING.EXE PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe PID 1956 wrote to memory of 572 1956 e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe"C:\Users\Admin\AppData\Local\Temp\e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -c 5 8.8.8.82⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\PING.EXEping -c 5 8.8.8.83⤵
- Runs ping.exe
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe"C:\Users\Admin\AppData\Local\Temp\e9162a72bf996d6201a3ff7f49c4ac9f01b6758e25fafb99354e18ea27fc7c13.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:572
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/572-64-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-66-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-56-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-60-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-62-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-76-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-75-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-57-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-73-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-68-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/572-69-0x0000000000452FFC-mapping.dmp
-
memory/572-72-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1164-59-0x0000000000000000-mapping.dmp
-
memory/1712-55-0x0000000000000000-mapping.dmp
-
memory/1956-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB