Analysis
-
max time kernel
205s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe
Resource
win10v2004-20220812-en
General
-
Target
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe
-
Size
175KB
-
MD5
fba3e964b429f06bea06e6d5e3ab8b08
-
SHA1
a13b91c0bc483458975a09330840521b269ffbbd
-
SHA256
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b
-
SHA512
c63431e907814f89d3b6d86fb95e637fc7ee15d0b23f8df0947e9e2f7fd8c528ab63d5b1723289e38ff66d63c252027846a0b092f387819ac407b27aba3588c1
-
SSDEEP
3072:23+zM8o1HWCbZa2C2wFP3KvqKHueMysYmPes/93JDYxBFt3xRKUFgXV+OBUFt8+c:25WWtIP8xwDJY8KI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 872 svchost.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
Processes:
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exepid process 2040 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\44f99d3a66eff659765dd3b8b0bbde86 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\44f99d3a66eff659765dd3b8b0bbde86 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .." svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe Token: 33 872 svchost.exe Token: SeIncBasePriorityPrivilege 872 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exesvchost.exedescription pid process target process PID 2040 wrote to memory of 872 2040 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe svchost.exe PID 2040 wrote to memory of 872 2040 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe svchost.exe PID 2040 wrote to memory of 872 2040 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe svchost.exe PID 2040 wrote to memory of 872 2040 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe svchost.exe PID 872 wrote to memory of 1156 872 svchost.exe netsh.exe PID 872 wrote to memory of 1156 872 svchost.exe netsh.exe PID 872 wrote to memory of 1156 872 svchost.exe netsh.exe PID 872 wrote to memory of 1156 872 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe"C:\Users\Admin\AppData\Local\Temp\6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
175KB
MD5fba3e964b429f06bea06e6d5e3ab8b08
SHA1a13b91c0bc483458975a09330840521b269ffbbd
SHA2566557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b
SHA512c63431e907814f89d3b6d86fb95e637fc7ee15d0b23f8df0947e9e2f7fd8c528ab63d5b1723289e38ff66d63c252027846a0b092f387819ac407b27aba3588c1
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
175KB
MD5fba3e964b429f06bea06e6d5e3ab8b08
SHA1a13b91c0bc483458975a09330840521b269ffbbd
SHA2566557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b
SHA512c63431e907814f89d3b6d86fb95e637fc7ee15d0b23f8df0947e9e2f7fd8c528ab63d5b1723289e38ff66d63c252027846a0b092f387819ac407b27aba3588c1
-
\Users\Admin\AppData\Roaming\svchost.exeFilesize
175KB
MD5fba3e964b429f06bea06e6d5e3ab8b08
SHA1a13b91c0bc483458975a09330840521b269ffbbd
SHA2566557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b
SHA512c63431e907814f89d3b6d86fb95e637fc7ee15d0b23f8df0947e9e2f7fd8c528ab63d5b1723289e38ff66d63c252027846a0b092f387819ac407b27aba3588c1
-
memory/872-58-0x0000000000000000-mapping.dmp
-
memory/872-61-0x0000000000950000-0x0000000000984000-memory.dmpFilesize
208KB
-
memory/1156-62-0x0000000000000000-mapping.dmp
-
memory/2040-54-0x00000000013C0000-0x00000000013F4000-memory.dmpFilesize
208KB
-
memory/2040-55-0x00000000004B0000-0x00000000004BE000-memory.dmpFilesize
56KB
-
memory/2040-56-0x0000000075C41000-0x0000000075C43000-memory.dmpFilesize
8KB