Analysis

  • max time kernel
    149s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2022, 01:49

General

  • Target

    f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194.exe

  • Size

    352KB

  • MD5

    fbd5f1fdda3eeee0a5baf8e863a6852c

  • SHA1

    734b825f09da67e5a1a3f86892c08792a7de7563

  • SHA256

    f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194

  • SHA512

    c5c0421439218671ba132b3d339de9afc5a21403687a3dcdcfbdd0f3dad9d51cfaf7049b6357f7ddebfa51b2badf4325047b73fe60962544653c3fe87ec55c10

  • SSDEEP

    6144:PhfqTIrbbeYoh9DpavsLktcrzsxkOibzVr8SRlEdQFlHfr/4VFh4:oVhHAsEcrz2kPYyEdQFl/UV

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194.exe
    "C:\Users\Admin\AppData\Local\Temp\f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Users\Admin\AppData\Local\Temp\f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194.exe
      "C:\Users\Admin\AppData\Local\Temp\f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194.exe"
      2⤵
      • Sets file execution options in registry
      • Checks for any installed AV software in registry
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:888
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x5E32073F" /TR "C:\ProgramData\svchost\qpqpdndnn.exe" /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:1228
      • C:\Windows\SysWOW64\WerFault.exe
        "C:\Windows\SysWOW64\WerFault.exe"
        3⤵
          PID:892

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/888-70-0x00000000000F0000-0x000000000013B000-memory.dmp

            Filesize

            300KB

          • memory/888-61-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/888-56-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/888-58-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/888-57-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/888-59-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/888-69-0x00000000000F0000-0x000000000013B000-memory.dmp

            Filesize

            300KB

          • memory/888-62-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/888-65-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/888-74-0x00000000000F0000-0x000000000013B000-memory.dmp

            Filesize

            300KB

          • memory/888-67-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/888-71-0x0000000000280000-0x000000000028B000-memory.dmp

            Filesize

            44KB

          • memory/892-75-0x0000000077D50000-0x0000000077ED1000-memory.dmp

            Filesize

            1.5MB

          • memory/892-76-0x0000000000110000-0x00000000001B6000-memory.dmp

            Filesize

            664KB

          • memory/892-79-0x0000000077D50000-0x0000000077ED1000-memory.dmp

            Filesize

            1.5MB

          • memory/892-80-0x0000000000110000-0x00000000001B6000-memory.dmp

            Filesize

            664KB

          • memory/1768-55-0x0000000074DB0000-0x000000007535B000-memory.dmp

            Filesize

            5.7MB

          • memory/1768-54-0x0000000076961000-0x0000000076963000-memory.dmp

            Filesize

            8KB

          • memory/1768-77-0x0000000074DB0000-0x000000007535B000-memory.dmp

            Filesize

            5.7MB

          • memory/1768-78-0x0000000000AD0000-0x0000000000B2E000-memory.dmp

            Filesize

            376KB

          • memory/1768-81-0x0000000000AD0000-0x0000000000B2E000-memory.dmp

            Filesize

            376KB