1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe
Size

151KB
MD5

ae94b23012157c6c7205b8428466fd47
SHA1

b630a8f7ee8806263b2abe5b0a0884ecf2193ba5
SHA256

1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1
SHA512

c828f741706e9a3f5c2772e1f8e217718e7ed4d54bf1bd55b61bb29b96ae1a668362e031252184b9898e9f6ed8a9d78aaaf2dd0bda05fc4a2f615f32fae27fb6
SSDEEP

3072:sLANnN/I9YHmMxd55YjB+4GSvquAJvJDsuMqd:sLANnq983vS5AN5t

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1264	svhst.exe
1212	svhst.exe

Loads dropped DLL 14 IoCs

pid	Process
1280	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe
1280	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe
1700	WerFault.exe
1700	WerFault.exe
1700	WerFault.exe
1700	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe
1700	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\run = "C:\\Users\\Admin\\AppData\\Roaming\\test\\svhst.exe"	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1264 set thread context of 1212	1264	svhst.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1700	1264	WerFault.exe	28
1056	1212	WerFault.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1280	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe
1264	svhst.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1264	1280	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe	28
PID 1280 wrote to memory of 1264	1280	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe	28
PID 1280 wrote to memory of 1264	1280	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe	28
PID 1280 wrote to memory of 1264	1280	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe	28
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1212	1264	svhst.exe	29
PID 1264 wrote to memory of 1700	1264	svhst.exe	30
PID 1264 wrote to memory of 1700	1264	svhst.exe	30
PID 1264 wrote to memory of 1700	1264	svhst.exe	30
PID 1264 wrote to memory of 1700	1264	svhst.exe	30
PID 1212 wrote to memory of 1056	1212	svhst.exe	31
PID 1212 wrote to memory of 1056	1212	svhst.exe	31
PID 1212 wrote to memory of 1056	1212	svhst.exe	31
PID 1212 wrote to memory of 1056	1212	svhst.exe	31

C:\Users\Admin\AppData\Local\Temp\1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe
"C:\Users\Admin\AppData\Local\Temp\1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Roaming\test\svhst.exe
  "C:\Users\Admin\AppData\Roaming\test\svhst.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Roaming\test\svhst.exe
    "C:\Users\Admin\AppData\Roaming\test\svhst.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 36
      4⤵
      Loads dropped DLL
      Program crash
      PID:1056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 392
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
C:\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
C:\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
memory/1212-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1280-61-0x0000000001DA0000-0x0000000001DA6000-memory.dmp

Filesize
24KB

Download
memory/1280-56-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download