Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 18:02
Behavioral task
behavioral1
Sample
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe
Resource
win10v2004-20220901-en
General
-
Target
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe
-
Size
56KB
-
MD5
b35a79c7cfee27644c72c02f713f032a
-
SHA1
16258f41d5c08019a002a484284176f8ce44072c
-
SHA256
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1
-
SHA512
f235e663022818a561a4b368477f5384c72cb2deb48e43d5551dda8a1df888e5bc1413eb92c49a71967472b472a7bbaefd539477332449d127754840bc40e346
-
SSDEEP
768:QUuzp0fg4fyRR5tHC4kt5Jp9k0FBxTJp8jSE5+Nk/QBeLPJcukgb4a:zfFYrHzmJcABxt2mE5OAkYJdz4a
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1480 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exepid process 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exepid process 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exedescription pid process Token: SeIncBasePriorityPrivilege 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exepid process 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.execmd.exedescription pid process target process PID 1148 wrote to memory of 1480 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe cmd.exe PID 1148 wrote to memory of 1480 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe cmd.exe PID 1148 wrote to memory of 1480 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe cmd.exe PID 1148 wrote to memory of 1480 1148 5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe cmd.exe PID 1480 wrote to memory of 1140 1480 cmd.exe PING.EXE PID 1480 wrote to memory of 1140 1480 cmd.exe PING.EXE PID 1480 wrote to memory of 1140 1480 cmd.exe PING.EXE PID 1480 wrote to memory of 1140 1480 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe"C:\Users\Admin\AppData\Local\Temp\5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:1140
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5d577f66de7124b80ef14b558be6a90f9
SHA1688c3cab5c53f1708adbf7f5e548deec69a316e2
SHA2564f14d7c1b36f30f3965cd3610538e3246cb6df8bf6472cf48eece6d9d516179c
SHA51216427d1eeab8ea8cdef25983ee14e12c783afbee1ccd7b0996a1481b1070267f0db61a9e3d76c69eec46379ed45c0da36e8cae167ecc2e8841c7fd7fc533ebbe