Analysis

  • max time kernel
    136s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 21:30

General

  • Target

    176566236674b67b5519cd77d03d01ddd8f6563d6cc411f9abc4316ce04e58c0.exe

  • Size

    512KB

  • MD5

    503daf77780b9c223e23f4a44f379f23

  • SHA1

    c9af4f598dc26159ae128dd8249f8d17ad489076

  • SHA256

    176566236674b67b5519cd77d03d01ddd8f6563d6cc411f9abc4316ce04e58c0

  • SHA512

    a6cafaee03d5f87e481b8d7b27531aa3fdf1f563232a84817556c41be0eb921775876704c85d5e769df5d6164f6be21c80d70e550cefad29f3a0cbb4ed778c48

  • SSDEEP

    12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4m:0+h9OY70z+warul3E4m

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\176566236674b67b5519cd77d03d01ddd8f6563d6cc411f9abc4316ce04e58c0.exe
    "C:\Users\Admin\AppData\Local\Temp\176566236674b67b5519cd77d03d01ddd8f6563d6cc411f9abc4316ce04e58c0.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\AppData\Local\Temp\n5214\s5214.exe
      "C:\Users\Admin\AppData\Local\Temp\n5214\s5214.exe" b5cf436ccc08237b574bc33ehJnOxdtVItdXWfjsWG2CISnx0ur5CDysboEFKptPs/ouWKWIBdqUMZvBPSvQ/vSoCl0RwlrrgE+FQ+I/70CfTjOh18SiQYv0FH+334i6+mQ+ee2OQfdPTDF5rlxuAgFCjzhiSRC/DHT7u+JJFaTr4L1v /v "C:\Users\Admin\AppData\Local\Temp\176566236674b67b5519cd77d03d01ddd8f6563d6cc411f9abc4316ce04e58c0.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1520

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\n5214\s5214.exe

          Filesize

          230KB

          MD5

          abaf13cb23de482dc944ab5b51ca3aac

          SHA1

          76837356db96dd56b647aba60f1adbbdc7b200fe

          SHA256

          b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

          SHA512

          cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

        • C:\Users\Admin\AppData\Local\Temp\n5214\s5214.exe

          Filesize

          230KB

          MD5

          abaf13cb23de482dc944ab5b51ca3aac

          SHA1

          76837356db96dd56b647aba60f1adbbdc7b200fe

          SHA256

          b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

          SHA512

          cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

        • \Users\Admin\AppData\Local\Temp\n5214\s5214.exe

          Filesize

          230KB

          MD5

          abaf13cb23de482dc944ab5b51ca3aac

          SHA1

          76837356db96dd56b647aba60f1adbbdc7b200fe

          SHA256

          b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

          SHA512

          cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

        • \Users\Admin\AppData\Local\Temp\n5214\s5214.exe

          Filesize

          230KB

          MD5

          abaf13cb23de482dc944ab5b51ca3aac

          SHA1

          76837356db96dd56b647aba60f1adbbdc7b200fe

          SHA256

          b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

          SHA512

          cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

        • \Users\Admin\AppData\Local\Temp\n5214\s5214.exe

          Filesize

          230KB

          MD5

          abaf13cb23de482dc944ab5b51ca3aac

          SHA1

          76837356db96dd56b647aba60f1adbbdc7b200fe

          SHA256

          b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

          SHA512

          cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

        • \Users\Admin\AppData\Local\Temp\n5214\s5214.exe

          Filesize

          230KB

          MD5

          abaf13cb23de482dc944ab5b51ca3aac

          SHA1

          76837356db96dd56b647aba60f1adbbdc7b200fe

          SHA256

          b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

          SHA512

          cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

        • memory/1520-62-0x000007FEF4260000-0x000007FEF4C83000-memory.dmp

          Filesize

          10.1MB

        • memory/1520-63-0x000007FEF31C0000-0x000007FEF4256000-memory.dmp

          Filesize

          16.6MB

        • memory/1520-64-0x00000000020B6000-0x00000000020D5000-memory.dmp

          Filesize

          124KB

        • memory/1520-65-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

          Filesize

          8KB

        • memory/1520-66-0x000007FEEE570000-0x000007FEEF3FF000-memory.dmp

          Filesize

          14.6MB

        • memory/1520-67-0x000007FEF2290000-0x000007FEF257A000-memory.dmp

          Filesize

          2.9MB

        • memory/1520-68-0x00000000020B6000-0x00000000020D5000-memory.dmp

          Filesize

          124KB

        • memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

          Filesize

          8KB