Analysis
-
max time kernel
250s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 23:03
Static task
static1
Behavioral task
behavioral1
Sample
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe
Resource
win10v2004-20220812-en
General
-
Target
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe
-
Size
272KB
-
MD5
36ba0cb1e5fbbcf2f0243e376ebe2b2e
-
SHA1
36e4a649cdd7101a8096470c66a3a30b6e9e6144
-
SHA256
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c
-
SHA512
b57f36302711e82327b8eb5ad2adf8ec4ff00efa2867b23ecf12b8411ced1b8dba11ac8a9faf6aac150925febab00468f513eb5f520a19d2cfaee4d8172f2b61
-
SSDEEP
6144:x81ynrsr6WJOeF/5kZMKZSDVZ6g7LaIQ4VRlxr3N3ctlTY:urdJOsvVZL3Q4nHrxITY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exepid process 1832 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1676 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exepid process 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Roaming\\Default Folder\\Default File.exe" 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exepid process 1832 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exedescription pid process Token: SeDebugPrivilege 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe Token: SeDebugPrivilege 1832 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe Token: SeDebugPrivilege 1832 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exepid process 1832 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.execmd.exedescription pid process target process PID 472 wrote to memory of 1832 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe PID 472 wrote to memory of 1832 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe PID 472 wrote to memory of 1832 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe PID 472 wrote to memory of 1832 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe PID 472 wrote to memory of 1676 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe cmd.exe PID 472 wrote to memory of 1676 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe cmd.exe PID 472 wrote to memory of 1676 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe cmd.exe PID 472 wrote to memory of 1676 472 8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe cmd.exe PID 1676 wrote to memory of 1436 1676 cmd.exe PING.EXE PID 1676 wrote to memory of 1436 1676 cmd.exe PING.EXE PID 1676 wrote to memory of 1436 1676 cmd.exe PING.EXE PID 1676 wrote to memory of 1436 1676 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe"C:\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe"C:\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1832 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:1436
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exeFilesize
272KB
MD536ba0cb1e5fbbcf2f0243e376ebe2b2e
SHA136e4a649cdd7101a8096470c66a3a30b6e9e6144
SHA2568cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c
SHA512b57f36302711e82327b8eb5ad2adf8ec4ff00efa2867b23ecf12b8411ced1b8dba11ac8a9faf6aac150925febab00468f513eb5f520a19d2cfaee4d8172f2b61
-
C:\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exeFilesize
272KB
MD536ba0cb1e5fbbcf2f0243e376ebe2b2e
SHA136e4a649cdd7101a8096470c66a3a30b6e9e6144
SHA2568cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c
SHA512b57f36302711e82327b8eb5ad2adf8ec4ff00efa2867b23ecf12b8411ced1b8dba11ac8a9faf6aac150925febab00468f513eb5f520a19d2cfaee4d8172f2b61
-
\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exeFilesize
272KB
MD536ba0cb1e5fbbcf2f0243e376ebe2b2e
SHA136e4a649cdd7101a8096470c66a3a30b6e9e6144
SHA2568cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c
SHA512b57f36302711e82327b8eb5ad2adf8ec4ff00efa2867b23ecf12b8411ced1b8dba11ac8a9faf6aac150925febab00468f513eb5f520a19d2cfaee4d8172f2b61
-
\Users\Admin\AppData\Local\Temp\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c\8cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c.exeFilesize
272KB
MD536ba0cb1e5fbbcf2f0243e376ebe2b2e
SHA136e4a649cdd7101a8096470c66a3a30b6e9e6144
SHA2568cafe642dbe02d9f2fc284e7deaa9e40ccc317091340b2a9e79b33f5daeb5f7c
SHA512b57f36302711e82327b8eb5ad2adf8ec4ff00efa2867b23ecf12b8411ced1b8dba11ac8a9faf6aac150925febab00468f513eb5f520a19d2cfaee4d8172f2b61
-
memory/472-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/472-55-0x0000000074E40000-0x00000000753EB000-memory.dmpFilesize
5.7MB
-
memory/472-64-0x0000000074E40000-0x00000000753EB000-memory.dmpFilesize
5.7MB
-
memory/1436-63-0x0000000000000000-mapping.dmp
-
memory/1676-62-0x0000000000000000-mapping.dmp
-
memory/1832-58-0x0000000000000000-mapping.dmp
-
memory/1832-65-0x0000000074E40000-0x00000000753EB000-memory.dmpFilesize
5.7MB
-
memory/1832-66-0x0000000074E40000-0x00000000753EB000-memory.dmpFilesize
5.7MB