Analysis
-
max time kernel
151s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 23:24
Static task
static1
Behavioral task
behavioral1
Sample
9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe
Resource
win10v2004-20220812-en
General
-
Target
9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe
-
Size
816KB
-
MD5
c7e0ea419d706b17c546f2165616db01
-
SHA1
ea2f53f39b43844e356fca1e07594603a2634fcd
-
SHA256
9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb
-
SHA512
b013abb1e117788f9191731ab6eeec202e8bcc4e36188ac5eab2217d51b3eb3ebf4bd95a8a12aea154ce0f6e325f9c78be93b936106e6d7d2cc41d8c2146d15c
-
SSDEEP
24576:Qp9M/ULsy3KihysUYYYYYYYYYYYRYYYYYYYYYYv:7/qsL0yvYYYYYYYYYYYRYYYYYYYYYYv
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
WindowsBenyo.exeexplorer.exepid process 1088 WindowsBenyo.exe 1240 explorer.exe 1268 -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d39d2048a79f06f908afa4217eb52f4c.exe explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d39d2048a79f06f908afa4217eb52f4c.exe explorer.exe -
Loads dropped DLL 1 IoCs
Processes:
9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exepid process 1712 9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\d39d2048a79f06f908afa4217eb52f4c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe\" .." explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d39d2048a79f06f908afa4217eb52f4c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe\" .." explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
explorer.exedescription pid process Token: SeDebugPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe Token: 33 1240 explorer.exe Token: SeIncBasePriorityPrivilege 1240 explorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exeexplorer.exedescription pid process target process PID 1712 wrote to memory of 1088 1712 9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe WindowsBenyo.exe PID 1712 wrote to memory of 1088 1712 9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe WindowsBenyo.exe PID 1712 wrote to memory of 1088 1712 9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe WindowsBenyo.exe PID 1712 wrote to memory of 1240 1712 9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe explorer.exe PID 1712 wrote to memory of 1240 1712 9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe explorer.exe PID 1712 wrote to memory of 1240 1712 9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe explorer.exe PID 1240 wrote to memory of 524 1240 explorer.exe netsh.exe PID 1240 wrote to memory of 524 1240 explorer.exe netsh.exe PID 1240 wrote to memory of 524 1240 explorer.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe"C:\Users\Admin\AppData\Local\Temp\9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WindowsBenyo.exe"C:\Users\Admin\AppData\Local\Temp\WindowsBenyo.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WindowsBenyo.exeFilesize
376KB
MD5f1f3f8a090be54ed9bbc1f127f631383
SHA1a1e376ad6b039c15c3d54e23f24b515eb5cae5df
SHA256990b60c90ba91ab8610a21d1047b1a559d238ad81edc30aacc8f0afad065af16
SHA5127130208b099721bf305fddadfcad83f9071a70936384d5105d27bc455f44a7a46c995e23f072dcffd1ddbdf8970aa92e89efb7759f7f8136c756139d207b8a1a
-
C:\Users\Admin\AppData\Local\Temp\WindowsBenyo.exeFilesize
376KB
MD5f1f3f8a090be54ed9bbc1f127f631383
SHA1a1e376ad6b039c15c3d54e23f24b515eb5cae5df
SHA256990b60c90ba91ab8610a21d1047b1a559d238ad81edc30aacc8f0afad065af16
SHA5127130208b099721bf305fddadfcad83f9071a70936384d5105d27bc455f44a7a46c995e23f072dcffd1ddbdf8970aa92e89efb7759f7f8136c756139d207b8a1a
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
262KB
MD5b81aacb4c52347090ad095e458e0217f
SHA1f685d5ddf22224b26adaf4b1e2220c11801d57e1
SHA256ecb692c580c8c40e7d1cc54b909e949d623ab19ce0c467f123390f2ef3e6a73b
SHA512b730393518a43f75ab4d3a00d71171f0c40185dddfa996c83c9e4888579b1eaf0b6ac3d67c91dda6f8b6f367373f1753431afc33592d02a3f441c0930aaa0f82
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
262KB
MD5b81aacb4c52347090ad095e458e0217f
SHA1f685d5ddf22224b26adaf4b1e2220c11801d57e1
SHA256ecb692c580c8c40e7d1cc54b909e949d623ab19ce0c467f123390f2ef3e6a73b
SHA512b730393518a43f75ab4d3a00d71171f0c40185dddfa996c83c9e4888579b1eaf0b6ac3d67c91dda6f8b6f367373f1753431afc33592d02a3f441c0930aaa0f82
-
\Users\Admin\AppData\Local\Temp\WindowsBenyo.exeFilesize
376KB
MD5f1f3f8a090be54ed9bbc1f127f631383
SHA1a1e376ad6b039c15c3d54e23f24b515eb5cae5df
SHA256990b60c90ba91ab8610a21d1047b1a559d238ad81edc30aacc8f0afad065af16
SHA5127130208b099721bf305fddadfcad83f9071a70936384d5105d27bc455f44a7a46c995e23f072dcffd1ddbdf8970aa92e89efb7759f7f8136c756139d207b8a1a
-
\Users\Admin\AppData\Local\Temp\WindowsBenyo.exeFilesize
376KB
MD5f1f3f8a090be54ed9bbc1f127f631383
SHA1a1e376ad6b039c15c3d54e23f24b515eb5cae5df
SHA256990b60c90ba91ab8610a21d1047b1a559d238ad81edc30aacc8f0afad065af16
SHA5127130208b099721bf305fddadfcad83f9071a70936384d5105d27bc455f44a7a46c995e23f072dcffd1ddbdf8970aa92e89efb7759f7f8136c756139d207b8a1a
-
memory/524-69-0x0000000000000000-mapping.dmp
-
memory/524-74-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/1088-68-0x0000000000150000-0x0000000000156000-memory.dmpFilesize
24KB
-
memory/1088-58-0x0000000000000000-mapping.dmp
-
memory/1088-75-0x000000001AF26000-0x000000001AF45000-memory.dmpFilesize
124KB
-
memory/1088-70-0x000000001AF26000-0x000000001AF45000-memory.dmpFilesize
124KB
-
memory/1088-66-0x00000000012A0000-0x0000000001304000-memory.dmpFilesize
400KB
-
memory/1240-64-0x000007FEF3BB0000-0x000007FEF45D3000-memory.dmpFilesize
10.1MB
-
memory/1240-67-0x0000000000AA6000-0x0000000000AC5000-memory.dmpFilesize
124KB
-
memory/1240-65-0x000007FEF2740000-0x000007FEF37D6000-memory.dmpFilesize
16.6MB
-
memory/1240-72-0x0000000000AA6000-0x0000000000AC5000-memory.dmpFilesize
124KB
-
memory/1240-60-0x0000000000000000-mapping.dmp
-
memory/1712-54-0x000007FEF3BB0000-0x000007FEF45D3000-memory.dmpFilesize
10.1MB
-
memory/1712-71-0x0000000002116000-0x0000000002135000-memory.dmpFilesize
124KB
-
memory/1712-55-0x000007FEF2740000-0x000007FEF37D6000-memory.dmpFilesize
16.6MB
-
memory/1712-56-0x0000000002116000-0x0000000002135000-memory.dmpFilesize
124KB