Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
25-11-2022 07:37
General
-
Target
7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738.exe
-
Size
379KB
-
MD5
d6ea81e78c57e02d4fd9f48544321988
-
SHA1
5da4748d0089fc7b0ff903e342e6f752c90388ba
-
SHA256
7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738
-
SHA512
201d39632b62e5d40f1d4fd9c02a52347b2578500aea2277d3cfb6dcf18812fdb238796acf264046d6e19f076eb28f8a255c47ccdac34ac27ab1a04288d132f4
-
SSDEEP
3072:UMxniMB1K2STu8geS2DI4AinsWZHeHc1VR7:RxiOJSTse9D4k+Hi7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738.exe"C:\Users\Admin\AppData\Local\Temp\7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\whatsapp.exe"C:\Users\Admin\AppData\Local\Temp\whatsapp.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\whatsapp.exe" "whatsapp.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\whatsapp.exeFilesize
379KB
MD5d6ea81e78c57e02d4fd9f48544321988
SHA15da4748d0089fc7b0ff903e342e6f752c90388ba
SHA2567b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738
SHA512201d39632b62e5d40f1d4fd9c02a52347b2578500aea2277d3cfb6dcf18812fdb238796acf264046d6e19f076eb28f8a255c47ccdac34ac27ab1a04288d132f4
-
C:\Users\Admin\AppData\Local\Temp\whatsapp.exeFilesize
379KB
MD5d6ea81e78c57e02d4fd9f48544321988
SHA15da4748d0089fc7b0ff903e342e6f752c90388ba
SHA2567b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738
SHA512201d39632b62e5d40f1d4fd9c02a52347b2578500aea2277d3cfb6dcf18812fdb238796acf264046d6e19f076eb28f8a255c47ccdac34ac27ab1a04288d132f4
-
\Users\Admin\AppData\Local\Temp\whatsapp.exeFilesize
379KB
MD5d6ea81e78c57e02d4fd9f48544321988
SHA15da4748d0089fc7b0ff903e342e6f752c90388ba
SHA2567b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738
SHA512201d39632b62e5d40f1d4fd9c02a52347b2578500aea2277d3cfb6dcf18812fdb238796acf264046d6e19f076eb28f8a255c47ccdac34ac27ab1a04288d132f4
-
memory/592-60-0x0000000000000000-mapping.dmp
-
memory/1160-56-0x0000000000000000-mapping.dmp
-
memory/1160-62-0x0000000074F30000-0x00000000754DB000-memory.dmpFilesize
5.7MB
-
memory/1160-64-0x0000000074F30000-0x00000000754DB000-memory.dmpFilesize
5.7MB
-
memory/1468-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1468-61-0x0000000074F30000-0x00000000754DB000-memory.dmpFilesize
5.7MB