Analysis
-
max time kernel
201s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:29
Static task
static1
Behavioral task
behavioral1
Sample
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
Resource
win10v2004-20221111-en
General
-
Target
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
-
Size
946KB
-
MD5
68e2b5e2d9f8c97fef076a22b680bb1d
-
SHA1
8b8a7b15c73c8cf416f4fc40b1301599d5b78ded
-
SHA256
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564
-
SHA512
b22423284ff1f8cc2dd10ed1cd9fb23471d19ce2b2afffff7396bdc5ba2e7a45a30cafa4573311aaae03e6e22aa4b3168ec14db2a9eecab8f420e689e316f612
-
SSDEEP
24576:Lbj1xNTf9fK3X2LMCBEcOaFxLpkaF9woZouHC:nV9flckRp3XZoYC
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
vmnat32 .exevmnat32 .exepid process 208 vmnat32 .exe 3524 vmnat32 .exe -
Processes:
resource yara_rule behavioral2/memory/3524-145-0x0000000001610000-0x0000000001720000-memory.dmp upx behavioral2/memory/3524-146-0x0000000001610000-0x0000000001720000-memory.dmp upx behavioral2/memory/3524-147-0x0000000001610000-0x0000000001720000-memory.dmp upx behavioral2/memory/3524-150-0x0000000001610000-0x0000000001720000-memory.dmp upx behavioral2/memory/3524-151-0x0000000001610000-0x0000000001720000-memory.dmp upx behavioral2/memory/3524-152-0x0000000001610000-0x0000000001720000-memory.dmp upx behavioral2/memory/3524-153-0x0000000001610000-0x0000000001720000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exevmnat32 .exedescription pid process target process PID 668 set thread context of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 208 set thread context of 3524 208 vmnat32 .exe vmnat32 .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vmnat32 .exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vmnat32 .exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags vmnat32 .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vmnat32 .exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags vmnat32 .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 vmnat32 .exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom vmnat32 .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 vmnat32 .exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom vmnat32 .exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exevmnat32 .exepid process 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe 3524 vmnat32 .exe 3524 vmnat32 .exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exedescription pid process Token: SeDebugPrivilege 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe Token: 33 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe Token: SeIncBasePriorityPrivilege 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vmnat32 .exevmnat32 .exepid process 208 vmnat32 .exe 3524 vmnat32 .exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.execmd.exevmnat32 .exedescription pid process target process PID 668 wrote to memory of 2436 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe cmd.exe PID 668 wrote to memory of 2436 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe cmd.exe PID 668 wrote to memory of 2436 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe cmd.exe PID 2436 wrote to memory of 112 2436 cmd.exe wscript.exe PID 2436 wrote to memory of 112 2436 cmd.exe wscript.exe PID 2436 wrote to memory of 112 2436 cmd.exe wscript.exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 668 wrote to memory of 208 668 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe vmnat32 .exe PID 208 wrote to memory of 3524 208 vmnat32 .exe vmnat32 .exe PID 208 wrote to memory of 3524 208 vmnat32 .exe vmnat32 .exe PID 208 wrote to memory of 3524 208 vmnat32 .exe vmnat32 .exe PID 208 wrote to memory of 3524 208 vmnat32 .exe vmnat32 .exe PID 208 wrote to memory of 3524 208 vmnat32 .exe vmnat32 .exe PID 208 wrote to memory of 3524 208 vmnat32 .exe vmnat32 .exe PID 208 wrote to memory of 3524 208 vmnat32 .exe vmnat32 .exe PID 208 wrote to memory of 3524 208 vmnat32 .exe vmnat32 .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe"C:\Users\Admin\AppData\Local\Temp\fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vmnat32\mata.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\vmnat32\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\vmnat32\mata2.bat"3⤵
-
C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe"C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe"C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\vmnat32 .exeFilesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
C:\Users\Admin\AppData\Local\Temp\vmnat32 .exeFilesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
C:\Users\Admin\AppData\Local\Temp\vmnat32 .exeFilesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
C:\Users\Admin\AppData\Local\Temp\vmnat32\mata.batFilesize
64B
MD5a8f6212dcdee196f8c2c4817a33d29b1
SHA112a7af0aec84dfe907d1e92bf357beb4fb8045ee
SHA256bb9f120c46293f14475af4eda500d904591d147bf7a1db2498635b08f89c8254
SHA51215cb773b072580e92965474ddc7cdd531509f79fa7701ab7496e3bf9a77ce512512b1fda2a71b03215b24fac346055db68782343d44e030b539982bc437444dc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ugZbB4g25fC\ugZbB4g25fC.datFilesize
2B
MD593e00066d099c0485cfffa1359246d26
SHA1bc69a773f37b2f2071e25f755a66d47b871e5d98
SHA2563b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde
SHA512d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ugZbB4g25fC\ugZbB4g25fC.nfoFilesize
3KB
MD5bdff6a728cf2f19109c578ddd6e8687c
SHA1ae0457c533bba1799df4aae97755798d7b8b5946
SHA256da85bbbc3fd708bd260239ea1c09fdfcd00847e7d5a19629c613ebe196ba4ca3
SHA5123d32ce12b58b371ea163d1c4911e9ef058e95c610c2a6a08104c210830157971b1c8f33690dd1844e8986f72da0efa8fb893d8b60fbbe762a12d80335efa99db
-
memory/112-136-0x0000000000000000-mapping.dmp
-
memory/208-137-0x0000000000000000-mapping.dmp
-
memory/208-138-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/208-141-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/208-142-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/668-133-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/668-143-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/668-132-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/2436-134-0x0000000000000000-mapping.dmp
-
memory/3524-144-0x0000000000000000-mapping.dmp
-
memory/3524-147-0x0000000001610000-0x0000000001720000-memory.dmpFilesize
1.1MB
-
memory/3524-150-0x0000000001610000-0x0000000001720000-memory.dmpFilesize
1.1MB
-
memory/3524-151-0x0000000001610000-0x0000000001720000-memory.dmpFilesize
1.1MB
-
memory/3524-152-0x0000000001610000-0x0000000001720000-memory.dmpFilesize
1.1MB
-
memory/3524-153-0x0000000001610000-0x0000000001720000-memory.dmpFilesize
1.1MB
-
memory/3524-146-0x0000000001610000-0x0000000001720000-memory.dmpFilesize
1.1MB
-
memory/3524-155-0x00000000016C5000-0x000000000171E000-memory.dmpFilesize
356KB
-
memory/3524-156-0x0000000001611000-0x00000000016C5000-memory.dmpFilesize
720KB
-
memory/3524-145-0x0000000001610000-0x0000000001720000-memory.dmpFilesize
1.1MB
-
memory/3524-158-0x00000000016C5000-0x000000000171E000-memory.dmpFilesize
356KB