Analysis

  • max time kernel
    141s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 12:57

General

  • Target

    b477b591e97b9baf766bc3d7c14d0c1e51f604b07c55ab3585c5800830769f5c.exe

  • Size

    253KB

  • MD5

    6f02982b41e04cbc36fb63774da221ae

  • SHA1

    8a011b383e42e6c71800c6fac13b85c00a0e5640

  • SHA256

    b477b591e97b9baf766bc3d7c14d0c1e51f604b07c55ab3585c5800830769f5c

  • SHA512

    4eee994bd8f28180a2ceeffe939a2f99dbb2c2e70192f7128f83bace85b6c9e78cc048f88be3afeecd2d71f4d7e4eb8ab505df02a65292d43bfcaf00b9f07b52

  • SSDEEP

    6144:aLBKpsNzAOR36nd5vr5dRBa0HzM04w4Ad:aNWshD3UXz5dPzM04w4Ad

Malware Config

Signatures

  • CryptOne packer 7 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b477b591e97b9baf766bc3d7c14d0c1e51f604b07c55ab3585c5800830769f5c.exe
    "C:\Users\Admin\AppData\Local\Temp\b477b591e97b9baf766bc3d7c14d0c1e51f604b07c55ab3585c5800830769f5c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Adds Run key to start application
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:904
      • C:\Windows\SysWOW64\notepad.exe
        "C:\Windows\SysWOW64\notepad.exe"
        3⤵
        • Deletes itself
        • Adds Run key to start application
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:820
    • C:\Windows\SysWOW64\calc.exe
      "C:\Windows\SysWOW64\calc.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:888
    • C:\Users\Admin\AppData\Local\Temp\b477b591e97b9baf766bc3d7c14d0c1e51f604b07c55ab3585c5800830769f5c.exe
      "C:\Users\Admin\AppData\Local\Temp\b477b591e97b9baf766bc3d7c14d0c1e51f604b07c55ab3585c5800830769f5c.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/820-91-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/820-112-0x00000000002E0000-0x000000000032E000-memory.dmp
    Filesize

    312KB

  • memory/820-327-0x00000000002E0000-0x000000000032E000-memory.dmp
    Filesize

    312KB

  • memory/820-177-0x00000000002E0000-0x000000000032E000-memory.dmp
    Filesize

    312KB

  • memory/820-119-0x00000000002E0000-0x000000000032E000-memory.dmp
    Filesize

    312KB

  • memory/820-126-0x00000000002E0000-0x000000000032E000-memory.dmp
    Filesize

    312KB

  • memory/820-71-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/820-74-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/820-73-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/820-69-0x0000000000000000-mapping.dmp
  • memory/820-72-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/888-131-0x00000000002F0000-0x000000000033E000-memory.dmp
    Filesize

    312KB

  • memory/888-113-0x00000000002F0000-0x000000000033E000-memory.dmp
    Filesize

    312KB

  • memory/888-324-0x0000000000328000-0x000000000032A000-memory.dmp
    Filesize

    8KB

  • memory/888-326-0x00000000002F0000-0x000000000033E000-memory.dmp
    Filesize

    312KB

  • memory/888-57-0x0000000000080000-0x0000000000082000-memory.dmp
    Filesize

    8KB

  • memory/888-61-0x0000000000000000-mapping.dmp
  • memory/888-66-0x0000000000080000-0x0000000000082000-memory.dmp
    Filesize

    8KB

  • memory/888-125-0x00000000002F0000-0x000000000033E000-memory.dmp
    Filesize

    312KB

  • memory/888-107-0x00000000002F0000-0x000000000033E000-memory.dmp
    Filesize

    312KB

  • memory/888-120-0x00000000002F0000-0x000000000033E000-memory.dmp
    Filesize

    312KB

  • memory/888-102-0x00000000002F0000-0x000000000033E000-memory.dmp
    Filesize

    312KB

  • memory/904-127-0x0000000000200000-0x000000000024E000-memory.dmp
    Filesize

    312KB

  • memory/904-114-0x0000000000200000-0x000000000024E000-memory.dmp
    Filesize

    312KB

  • memory/904-56-0x00000000000C0000-0x00000000000E9000-memory.dmp
    Filesize

    164KB

  • memory/904-92-0x00000000000C0000-0x00000000000E9000-memory.dmp
    Filesize

    164KB

  • memory/904-121-0x0000000000200000-0x000000000024E000-memory.dmp
    Filesize

    312KB

  • memory/904-98-0x0000000000200000-0x000000000024E000-memory.dmp
    Filesize

    312KB

  • memory/904-325-0x0000000000200000-0x000000000024E000-memory.dmp
    Filesize

    312KB

  • memory/904-65-0x00000000000C0000-0x00000000000E9000-memory.dmp
    Filesize

    164KB

  • memory/904-60-0x0000000000000000-mapping.dmp
  • memory/904-101-0x0000000000200000-0x000000000024E000-memory.dmp
    Filesize

    312KB

  • memory/904-106-0x0000000000200000-0x000000000024E000-memory.dmp
    Filesize

    312KB

  • memory/1320-118-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-78-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-84-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-75-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-88-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-80-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-93-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-85-0x0000000000410910-mapping.dmp
  • memory/1320-82-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-90-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/1320-76-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

  • memory/2012-64-0x0000000000400000-0x0000000001400000-memory.dmp
    Filesize

    16.0MB

  • memory/2012-55-0x00000000001D0000-0x00000000001E3000-memory.dmp
    Filesize

    76KB

  • memory/2012-89-0x0000000000400000-0x0000000001400000-memory.dmp
    Filesize

    16.0MB

  • memory/2012-54-0x0000000075281000-0x0000000075283000-memory.dmp
    Filesize

    8KB