be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8

Analysis

max time kernel
152s
max time network
87s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe
Size

2.6MB
MD5

1eb78a094e93680ce4ff985fabc724fb
SHA1

a1d1bf558224e46461f40c93240a7c0bce2cc770
SHA256

be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8
SHA512

ac8b7e57991b5953c7eee384b056e9adfaa1f2a8bae50831ea91f4a4874da0e12d35cde35f4b7c4a261aa7bd10332a58b4ab21793f572a17cc8d5be2e5f73027
SSDEEP

49152:2toK3MJgWJfjRiFqpfSdXYjy0n4w1Ou8HG3WE/OWwcBEP2KHgDfcg+QVX1mEsMFt:qMisiFq4XYm091OufGPLclKHUcgnVQcf

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

Processes:

be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe
File created	C:\Windows\system32\drivers\KTDxa.sys	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe
File opened for modification	C:\Windows\system32\drivers\etc	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

pid process

1352 be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

description pid process

Token: SeDebugPrivilege 1352 be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1352	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

pid	process
1352	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe
1352	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe

description	pid	process	target process
PID 1352 wrote to memory of 672	1352	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe	cmd.exe
PID 1352 wrote to memory of 672	1352	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe	cmd.exe
PID 1352 wrote to memory of 672	1352	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe	cmd.exe
PID 1352 wrote to memory of 672	1352	be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe
"C:\Users\Admin\AppData\Local\Temp\be069e1997768a9333c4a4ee0185fb0dc7f131f1688b6b8bd6cc23ab430c37d8.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etcbRQWQ" /S /Q
2⤵
PID:672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-56-0x0000000000000000-mapping.dmp

Download
memory/1352-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1352-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1352-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download