Overview
overview
10Static
static
12014-12-22...b2.exe
windows7-x64
82014-12-22...b2.exe
windows10-2004-x64
82014-12-22...48.exe
windows7-x64
72014-12-22...48.exe
windows10-2004-x64
72014-12-22...ce.exe
windows7-x64
12014-12-22...ce.exe
windows10-2004-x64
12014-12-22...a4.exe
windows7-x64
32014-12-22...a4.exe
windows10-2004-x64
32014-12-22...35.exe
windows7-x64
82014-12-22...35.exe
windows10-2004-x64
72014-12-22...bb.exe
windows7-x64
102014-12-22...bb.exe
windows10-2004-x64
102014-12-22...76.exe
windows7-x64
82014-12-22...76.exe
windows10-2004-x64
82014-12-22...57.exe
windows7-x64
62014-12-22...57.exe
windows10-2004-x64
62014-12-22...8c.exe
windows7-x64
102014-12-22...8c.exe
windows10-2004-x64
102014-12-22...6a.exe
windows7-x64
82014-12-22...6a.exe
windows10-2004-x64
82014-12-22...d0.exe
windows7-x64
102014-12-22...d0.exe
windows10-2004-x64
102014-12-22...ee.exe
windows7-x64
82014-12-22...ee.exe
windows10-2004-x64
82014-12-22...7d.exe
windows7-x64
82014-12-22...7d.exe
windows10-2004-x64
102014-12-22...c3.exe
windows7-x64
82014-12-22...c3.exe
windows10-2004-x64
82014-12-22...12.exe
windows7-x64
82014-12-22...12.exe
windows10-2004-x64
82014-12-22...76.exe
windows7-x64
62014-12-22...76.exe
windows10-2004-x64
6Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 11:47
Static task
static1
Behavioral task
behavioral1
Sample
2014-12-22 #32/12923268c928f103f7f0164be1985cb2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2014-12-22 #32/12923268c928f103f7f0164be1985cb2.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
2014-12-22 #32/143821c328d1e9cb4d0d9e0389d85848.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
2014-12-22 #32/143821c328d1e9cb4d0d9e0389d85848.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
2014-12-22 #32/1952f6f1225202929d7be4217473e7ce.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
2014-12-22 #32/1952f6f1225202929d7be4217473e7ce.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
2014-12-22 #32/1b19dc758fc785466abfd973f125e0a4.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
2014-12-22 #32/1b19dc758fc785466abfd973f125e0a4.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
2014-12-22 #32/1c5f3bf4ddc6f255a71788deeb052435.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
2014-12-22 #32/1c5f3bf4ddc6f255a71788deeb052435.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
2014-12-22 #32/362a366e1bb65d96b8c0eda30c3599bb.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
2014-12-22 #32/362a366e1bb65d96b8c0eda30c3599bb.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
2014-12-22 #32/39ba57532da96906e6ddbe8669011e76.exe
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
2014-12-22 #32/39ba57532da96906e6ddbe8669011e76.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
2014-12-22 #32/409541f2ca9bc08e528a05970e278e57.exe
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
2014-12-22 #32/409541f2ca9bc08e528a05970e278e57.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
2014-12-22 #32/41378f6611e67fca821266bd8d84698c.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
2014-12-22 #32/41378f6611e67fca821266bd8d84698c.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
2014-12-22 #32/439dce6b40c39157a046563bcb5e3a6a.exe
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
2014-12-22 #32/439dce6b40c39157a046563bcb5e3a6a.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
2014-12-22 #32/639d9e895b7e220be010b3c90432b6d0.exe
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
2014-12-22 #32/639d9e895b7e220be010b3c90432b6d0.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
2014-12-22 #32/64fbde6dd4ddff6293c9e71c9fb23cee.exe
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
2014-12-22 #32/64fbde6dd4ddff6293c9e71c9fb23cee.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
2014-12-22 #32/7203e66c5a6aa9a0be7162b05151dc7d.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
2014-12-22 #32/7203e66c5a6aa9a0be7162b05151dc7d.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
2014-12-22 #32/7d6cbda928ce43eb520730a94c4f33c3.exe
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
2014-12-22 #32/7d6cbda928ce43eb520730a94c4f33c3.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
2014-12-22 #32/8164856e9e00ff929e519b7f4ed2df12.exe
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
2014-12-22 #32/8164856e9e00ff929e519b7f4ed2df12.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
2014-12-22 #32/864f15a5f814d374bd36992bea448276.exe
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
2014-12-22 #32/864f15a5f814d374bd36992bea448276.exe
Resource
win10v2004-20220812-en
General
-
Target
2014-12-22 #32/7203e66c5a6aa9a0be7162b05151dc7d.exe
-
Size
451KB
-
MD5
7203e66c5a6aa9a0be7162b05151dc7d
-
SHA1
572b932565334b97736f25bb3a92b49917db6c2a
-
SHA256
2eab200f3227e5174fd85f16f303785d5cd3fda52ae53b08685ace3287c88651
-
SHA512
e769cf17f339cde58296cbffe850972f9f62dd260ec3626b210c634d38e102d1980bd93bb8697c1281498097aa1d7909e687caff70475aaf95f69067de690715
-
SSDEEP
3072:0yNxrONdDt+iVR3VqDe3+YjYk/bRrA0Uf51rGWCWm59IUafckvNYWFfkz25W8pyI:BNxqR+YR4TYJoLASQN8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
TEMP.exepid process 936 TEMP.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
TEMP.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\533f5e20c0cbf63ea3616363651d2090.exe TEMP.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\533f5e20c0cbf63ea3616363651d2090.exe TEMP.exe -
Loads dropped DLL 1 IoCs
Processes:
7203e66c5a6aa9a0be7162b05151dc7d.exepid process 1992 7203e66c5a6aa9a0be7162b05151dc7d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
TEMP.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\533f5e20c0cbf63ea3616363651d2090 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TEMP.exe\" .." TEMP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\533f5e20c0cbf63ea3616363651d2090 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TEMP.exe\" .." TEMP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
TEMP.exedescription pid process Token: SeDebugPrivilege 936 TEMP.exe Token: 33 936 TEMP.exe Token: SeIncBasePriorityPrivilege 936 TEMP.exe Token: 33 936 TEMP.exe Token: SeIncBasePriorityPrivilege 936 TEMP.exe Token: 33 936 TEMP.exe Token: SeIncBasePriorityPrivilege 936 TEMP.exe Token: 33 936 TEMP.exe Token: SeIncBasePriorityPrivilege 936 TEMP.exe Token: 33 936 TEMP.exe Token: SeIncBasePriorityPrivilege 936 TEMP.exe Token: 33 936 TEMP.exe Token: SeIncBasePriorityPrivilege 936 TEMP.exe Token: 33 936 TEMP.exe Token: SeIncBasePriorityPrivilege 936 TEMP.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7203e66c5a6aa9a0be7162b05151dc7d.exeTEMP.exedescription pid process target process PID 1992 wrote to memory of 936 1992 7203e66c5a6aa9a0be7162b05151dc7d.exe TEMP.exe PID 1992 wrote to memory of 936 1992 7203e66c5a6aa9a0be7162b05151dc7d.exe TEMP.exe PID 1992 wrote to memory of 936 1992 7203e66c5a6aa9a0be7162b05151dc7d.exe TEMP.exe PID 1992 wrote to memory of 936 1992 7203e66c5a6aa9a0be7162b05151dc7d.exe TEMP.exe PID 936 wrote to memory of 1436 936 TEMP.exe netsh.exe PID 936 wrote to memory of 1436 936 TEMP.exe netsh.exe PID 936 wrote to memory of 1436 936 TEMP.exe netsh.exe PID 936 wrote to memory of 1436 936 TEMP.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2014-12-22 #32\7203e66c5a6aa9a0be7162b05151dc7d.exe"C:\Users\Admin\AppData\Local\Temp\2014-12-22 #32\7203e66c5a6aa9a0be7162b05151dc7d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\TEMP.exe"C:\Users\Admin\AppData\Local\Temp\TEMP.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\TEMP.exe" "TEMP.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1436
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD57203e66c5a6aa9a0be7162b05151dc7d
SHA1572b932565334b97736f25bb3a92b49917db6c2a
SHA2562eab200f3227e5174fd85f16f303785d5cd3fda52ae53b08685ace3287c88651
SHA512e769cf17f339cde58296cbffe850972f9f62dd260ec3626b210c634d38e102d1980bd93bb8697c1281498097aa1d7909e687caff70475aaf95f69067de690715
-
Filesize
451KB
MD57203e66c5a6aa9a0be7162b05151dc7d
SHA1572b932565334b97736f25bb3a92b49917db6c2a
SHA2562eab200f3227e5174fd85f16f303785d5cd3fda52ae53b08685ace3287c88651
SHA512e769cf17f339cde58296cbffe850972f9f62dd260ec3626b210c634d38e102d1980bd93bb8697c1281498097aa1d7909e687caff70475aaf95f69067de690715
-
Filesize
451KB
MD57203e66c5a6aa9a0be7162b05151dc7d
SHA1572b932565334b97736f25bb3a92b49917db6c2a
SHA2562eab200f3227e5174fd85f16f303785d5cd3fda52ae53b08685ace3287c88651
SHA512e769cf17f339cde58296cbffe850972f9f62dd260ec3626b210c634d38e102d1980bd93bb8697c1281498097aa1d7909e687caff70475aaf95f69067de690715