Analysis
-
max time kernel
126s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:32
Static task
static1
Behavioral task
behavioral1
Sample
001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe
Resource
win10v2004-20221111-en
General
-
Target
001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe
-
Size
2.2MB
-
MD5
b4ad074a8cc0932332dd435c4ec3052e
-
SHA1
1654e08d948b9a78d54bb143f49acc1dd088835d
-
SHA256
001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3
-
SHA512
80adc6c39e1f227f4e3ec02333f4ecdbaa06391757e0b27fa3927fea772a13bfb1192b132766cd9f860389c5c41f500b60b94c2c437e32689cdf3b45761472a4
-
SSDEEP
49152:WuWek/PEyYF3YyKbYuWP1Cv+9iw7ejivqrt5PmZSoaXUHQ16:QXqe8xP1ri865PIaXZ16
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
KUB.exepid process 1956 KUB.exe -
Loads dropped DLL 4 IoCs
Processes:
001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exeKUB.exeDllHost.exepid process 1476 001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe 1956 KUB.exe 1348 DllHost.exe 1476 001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
KUB.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run KUB.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KUB Start = "C:\\ProgramData\\LGGKBU\\KUB.exe" KUB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
KUB.exepid process 1956 KUB.exe 1956 KUB.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
KUB.exepid process 1956 KUB.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1348 DllHost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
KUB.exepid process 1956 KUB.exe 1956 KUB.exe 1956 KUB.exe 1956 KUB.exe 1956 KUB.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exedescription pid process target process PID 1476 wrote to memory of 1956 1476 001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe KUB.exe PID 1476 wrote to memory of 1956 1476 001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe KUB.exe PID 1476 wrote to memory of 1956 1476 001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe KUB.exe PID 1476 wrote to memory of 1956 1476 001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe KUB.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe"C:\Users\Admin\AppData\Local\Temp\001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\LGGKBU\KUB.exe"C:\ProgramData\LGGKBU\KUB.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\LGGKBU\KUB.00Filesize
2KB
MD5f9e49f33a333b1b61d52538a8e49b99e
SHA1bd40dda68204a726e8e4d8ca8375157059a118e9
SHA256966722aff64ad9a3c4ef1bf36a2fc1133b9c8266b4e6304feaf0eb914b385514
SHA512f762c437f727cae3d67d3cefd0b39ea922b56367b4a43565cb3f1ccf043974291b5a984f8ba13708ba6fa3042d6586606fc92b39657b4f86ea3b4be763ca2232
-
C:\ProgramData\LGGKBU\KUB.01Filesize
80KB
MD573ecd165caf523ac9fc02542a0a93783
SHA1d267cc30b7c7eda31b5b8c2e64073e443c2668a9
SHA25693b7d535f84e308025ba7aeeae27032dcbc015119c59142ecad25b1f28fe47c9
SHA512711abb91062540c70d31e177d9e16b68022b3ed0042668233b54d76f780cc1cb10ae04f9c5ad6be2828ef4e002b09c6328d9af76709274835887f7d83c68338d
-
C:\ProgramData\LGGKBU\KUB.exeFilesize
2.4MB
MD550397dee100535a5c76759ba33871b0d
SHA121eebd3baf3642f8cc9e57b46e3321e25b63e3e5
SHA256ef567d0021c74b99011379cbc02d132d87fb771009b6821b981e06cf62f2761a
SHA512a64f9031fef566f71b39294cc9cbfeb14b528e5cb67bbaec684a6bd34a7e03515e3fd5351f0a36c27d70938c1b7c89d5d3c91ddafa1d4d6eab447e5ec941dff8
-
C:\Users\Admin\AppData\Local\Temp\0845_9b1c.jpegFilesize
158KB
MD59c40c8c90e045872e258bf5b49b4e6ef
SHA149426f3af25eb4dfdc33b6cdddd53fe16ab159a6
SHA25645a2c9e549b7e60cb25b08cd2ba1b8caa0b89be1d204d0e1a1f8a1be51fa97b1
SHA512150f8dad5518bde1f0150bdfcca6d5bb191238984f3af6b6c594f7ebdf34141bf5f66fb6591d13fcca3ce62d5fdebe8b6806840f3e7fb4472e0c9bc6527e852d
-
\ProgramData\LGGKBU\KUB.01Filesize
80KB
MD573ecd165caf523ac9fc02542a0a93783
SHA1d267cc30b7c7eda31b5b8c2e64073e443c2668a9
SHA25693b7d535f84e308025ba7aeeae27032dcbc015119c59142ecad25b1f28fe47c9
SHA512711abb91062540c70d31e177d9e16b68022b3ed0042668233b54d76f780cc1cb10ae04f9c5ad6be2828ef4e002b09c6328d9af76709274835887f7d83c68338d
-
\ProgramData\LGGKBU\KUB.01Filesize
80KB
MD573ecd165caf523ac9fc02542a0a93783
SHA1d267cc30b7c7eda31b5b8c2e64073e443c2668a9
SHA25693b7d535f84e308025ba7aeeae27032dcbc015119c59142ecad25b1f28fe47c9
SHA512711abb91062540c70d31e177d9e16b68022b3ed0042668233b54d76f780cc1cb10ae04f9c5ad6be2828ef4e002b09c6328d9af76709274835887f7d83c68338d
-
\ProgramData\LGGKBU\KUB.01Filesize
80KB
MD573ecd165caf523ac9fc02542a0a93783
SHA1d267cc30b7c7eda31b5b8c2e64073e443c2668a9
SHA25693b7d535f84e308025ba7aeeae27032dcbc015119c59142ecad25b1f28fe47c9
SHA512711abb91062540c70d31e177d9e16b68022b3ed0042668233b54d76f780cc1cb10ae04f9c5ad6be2828ef4e002b09c6328d9af76709274835887f7d83c68338d
-
\ProgramData\LGGKBU\KUB.exeFilesize
2.4MB
MD550397dee100535a5c76759ba33871b0d
SHA121eebd3baf3642f8cc9e57b46e3321e25b63e3e5
SHA256ef567d0021c74b99011379cbc02d132d87fb771009b6821b981e06cf62f2761a
SHA512a64f9031fef566f71b39294cc9cbfeb14b528e5cb67bbaec684a6bd34a7e03515e3fd5351f0a36c27d70938c1b7c89d5d3c91ddafa1d4d6eab447e5ec941dff8
-
memory/1348-72-0x0000000000140000-0x0000000000159000-memory.dmpFilesize
100KB
-
memory/1348-66-0x0000000000140000-0x0000000000159000-memory.dmpFilesize
100KB
-
memory/1476-54-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1476-71-0x0000000000800000-0x0000000000819000-memory.dmpFilesize
100KB
-
memory/1476-55-0x0000000000330000-0x0000000000569000-memory.dmpFilesize
2.2MB
-
memory/1476-69-0x0000000000800000-0x0000000000819000-memory.dmpFilesize
100KB
-
memory/1476-70-0x0000000000330000-0x0000000000569000-memory.dmpFilesize
2.2MB
-
memory/1956-57-0x0000000000000000-mapping.dmp
-
memory/1956-64-0x0000000000730000-0x0000000000749000-memory.dmpFilesize
100KB
-
memory/1956-63-0x0000000000730000-0x0000000000749000-memory.dmpFilesize
100KB