Overview

overview

7

Static

static

7a70f9ac21...02.exe

windows7-x64

7

7a70f9ac21...02.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 08:17 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a70f9ac21caea46da61e0adbe6a0c3260f2f98afe47134266f822c784c9ea02.exe

  • Size

    3.9MB

  • MD5

    3503572a19f27ebdda6a2937f089fde2

  • SHA1

    ac44aacf51a145ba72cb7b17e9db5b0100985035

  • SHA256

    7a70f9ac21caea46da61e0adbe6a0c3260f2f98afe47134266f822c784c9ea02

  • SHA512

    b2e47b812706b31e726ba4402a058e066b7e27f265aaf8188495e0be20f1dd9e22712e0b7003ff0a02a263567586ed4062fb742671e7d82a7d0416c5f94bfbc5

  • SSDEEP

    98304:RDGnkRWN+Ci067DeL2iUZz9ZdvyjfXMNgvHNIekdwLBWdwLA:gN+Cw62Nrv0fXMNetIPwL8wLA

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a70f9ac21caea46da61e0adbe6a0c3260f2f98afe47134266f822c784c9ea02.exe
    "C:\Users\Admin\AppData\Local\Temp\7a70f9ac21caea46da61e0adbe6a0c3260f2f98afe47134266f822c784c9ea02.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:1392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1272
      2⤵
      • Program crash
      PID:1268
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1392 -ip 1392
    1⤵
      PID:260

    Network

    • flag-unknown
      DNS
      Remote address:
      8.238.21.126:80
      Response
      HTTP/1.1 304 Not Modified
      Date: Mon, 28 Nov 2022 03:51:09 GMT
      Connection: keep-alive
      Cache-Control: public, max-age=900
      ETag: "08f5ab0361ad71:0"
      Expires: Mon, 28 Nov 2022 04:06:09 GMT
      Last-Modified: Tue, 16 Mar 2021 07:33:42 GMT
      Server: Microsoft-IIS/10.0
      X-Powered-By: ASP.NET
      X-CID: 3
      X-CCC: NL
      MSREGION: EMEA
      Age: 499
    • flag-unknown
      DNS
      config.dianxinkan.com
      7a70f9ac21caea46da61e0adbe6a0c3260f2f98afe47134266f822c784c9ea02.exe
      Remote address:
      8.8.8.8:53
      Request
      config.dianxinkan.com
      IN A
      Response
      config.dianxinkan.com
      IN CNAME
      ziyuan.baidu.com
      ziyuan.baidu.com
      IN CNAME
      ziyuan.n.shifen.com
      ziyuan.n.shifen.com
      IN A
      182.61.201.50
      ziyuan.n.shifen.com
      IN A
      182.61.201.90
      ziyuan.n.shifen.com
      IN A
      182.61.201.91
      ziyuan.n.shifen.com
      IN A
      182.61.201.92
    • flag-unknown
      DNS
      96.108.152.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      96.108.152.52.in-addr.arpa
      IN PTR
      Response
    • flag-unknown
      DNS
      2.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
      IN PTR
      Response
    • 8.238.21.126:80
      http
      704 B
       548 B
       8
      5

      HTTP Response

      304
    • 8.238.21.126:80
      260 B
       5
    • 93.184.220.29:80
      322 B
       7
    • 182.61.201.50:80
      config.dianxinkan.com
      7a70f9ac21caea46da61e0adbe6a0c3260f2f98afe47134266f822c784c9ea02.exe
      260 B
       5
    • 93.184.220.29:80
      260 B
       5
    • 20.190.160.22:443
      260 B
       5
    • 8.253.208.120:80
      260 B
       5
    • 20.224.254.73:443
      40 B
       1
    • 20.189.173.12:443
      322 B
       7
    • 8.238.21.126:80
      322 B
       7
    • 8.238.21.126:80
      322 B
       7
    • 8.238.21.126:80
      322 B
       7
    • 8.238.21.126:80
      260 B
       5
    • 20.190.160.22:443
      260 B
       5
    • 104.80.225.205:443
      322 B
       7
    • 8.253.208.120:80
      260 B
       5
    • 67.24.35.254:80
      260 B
       5
    • 8.247.211.126:80
      260 B
       5
    • 8.238.21.254:80
      156 B
       3
    • 8.8.8.8:53
      config.dianxinkan.com
      dns
      7a70f9ac21caea46da61e0adbe6a0c3260f2f98afe47134266f822c784c9ea02.exe
      67 B
       188 B
       1
      1

      DNS Request

      config.dianxinkan.com

      DNS Response

      182.61.201.50
      182.61.201.90
      182.61.201.91
      182.61.201.92

    • 8.8.8.8:53
      96.108.152.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      96.108.152.52.in-addr.arpa

    • 8.8.8.8:53
      2.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
      dns
      118 B
       204 B
       1
      1

      DNS Request

      2.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\112845922357\LZMA.dll
      Filesize

      67KB

      MD5

      d0f2416807f04c559e6394a0a4c7f1d1

      SHA1

      7df43ffa3716156d282b1e37d12dd1122f0a762c

      SHA256

      0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

      SHA512

      8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

      Download Submit

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.