8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

Analysis

max time kernel
54s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe
Size

103KB
MD5

af492f4985b1486f035a2199086921c3
SHA1

748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0
SHA256

8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71
SHA512

7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a
SSDEEP

3072:DWw/LXWDZ+DxBNb1SpuxJqQRmxrXbLWGO:DWw/DW5uaQRQfY

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
548	winlogin.exe

Deletes itself 1 IoCs

pid	Process
880	cmd.exe

Loads dropped DLL 8 IoCs

pid	Process
880	cmd.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	548	WerFault.exe	33

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
944	PING.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 960	1504	8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe	28
PID 1504 wrote to memory of 960	1504	8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe	28
PID 1504 wrote to memory of 960	1504	8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe	28
PID 1504 wrote to memory of 960	1504	8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe	28
PID 1504 wrote to memory of 880	1504	8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe	30
PID 1504 wrote to memory of 880	1504	8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe	30
PID 1504 wrote to memory of 880	1504	8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe	30
PID 1504 wrote to memory of 880	1504	8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe	30
PID 880 wrote to memory of 944	880	cmd.exe	32
PID 880 wrote to memory of 944	880	cmd.exe	32
PID 880 wrote to memory of 944	880	cmd.exe	32
PID 880 wrote to memory of 944	880	cmd.exe	32
PID 880 wrote to memory of 548	880	cmd.exe	33
PID 880 wrote to memory of 548	880	cmd.exe	33
PID 880 wrote to memory of 548	880	cmd.exe	33
PID 880 wrote to memory of 548	880	cmd.exe	33
PID 548 wrote to memory of 1460	548	winlogin.exe	34
PID 548 wrote to memory of 1460	548	winlogin.exe	34
PID 548 wrote to memory of 1460	548	winlogin.exe	34
PID 548 wrote to memory of 1460	548	winlogin.exe	34

C:\Users\Admin\AppData\Local\Temp\8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe
"C:\Users\Admin\AppData\Local\Temp\8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd /D /R type "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" > ___ && move /Y ___ "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
  2⤵
  PID:960
- C:\Windows\SysWOW64\cmd.exe
  cmd /D /R ping -n 10 localhost && del "C:\Users\Admin\AppData\Local\Temp\8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71.exe" && start /B "" "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe" && exit
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:944
- - C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe
    "C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 344
      4⤵
      Loads dropped DLL
      Program crash
      PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
\Users\Admin\AppData\Roaming\Windows\winlogin.exe

Filesize
103KB

MD5
af492f4985b1486f035a2199086921c3

SHA1
748a4865c24eb3c0e21a5b9e6e32a8f9ac2130f0

SHA256
8be655497ded041cc896788e543e5dad24a5dea518f9d869e376948b004c2e71

SHA512
7cb35416aa9e537438158acba7b2bbd9685466800bcfe99429b90e26d80eae598f89c3d8728118aa08e93cf372b0f8bf0c7e5249b695dee7d41506cfd161088a

Download Submit
memory/1504-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x00000000024A0000-0x00000000025B9000-memory.dmp

Filesize
1.1MB

Download
memory/1504-58-0x00000000024A0000-0x00000000025B9000-memory.dmp

Filesize
1.1MB

Download