Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 12:32
Behavioral task
behavioral1
Sample
5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe
Resource
win10v2004-20220812-en
General
-
Target
5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe
-
Size
122KB
-
MD5
9af7d469610185bfa0d6b4e420339f4e
-
SHA1
1c51549da0de81a4bca01859323ce8c6d84d5c15
-
SHA256
5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3
-
SHA512
b499d355ccb783213936a62b19a060a28dc141ddd5b5c0875837b7d13551990fb3368204d518f25834f3305aac7f5673d9cee4bba760853298eb490b155fabaf
-
SSDEEP
3072:bnDHH47khTSHz4dwqKdM6i4JGpZh37uLjudqz9d0kj:bDn440zt46i4EruLorkj
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\IPv6NetBrowsSvc\Parameters\ServiceDll = "C:\\Windows\\IPv6NetBrowsSvc.dll" 5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe -
Processes:
resource yara_rule \??\c:\windows\ipv6netbrowssvc.dll vmprotect behavioral1/memory/832-59-0x0000000000E30000-0x0000000000E6E000-memory.dmp vmprotect behavioral1/memory/1240-61-0x00000000755E0000-0x000000007561E000-memory.dmp vmprotect behavioral1/memory/1240-62-0x00000000755E0000-0x000000007561E000-memory.dmp vmprotect -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1976 cmd.exe -
Drops file in Windows directory 2 IoCs
Processes:
5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exedescription ioc process File created C:\Windows\IPv6NetBrowsSvc.dll 5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe File opened for modification C:\Windows\IPv6NetBrowsSvc.dll 5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exedescription pid process target process PID 832 wrote to memory of 1976 832 5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe cmd.exe PID 832 wrote to memory of 1976 832 5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe cmd.exe PID 832 wrote to memory of 1976 832 5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe cmd.exe PID 832 wrote to memory of 1976 832 5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe"C:\Users\Admin\AppData\Local\Temp\5a3ffc6a89772bf529cd4dd8df0ac340db29974f000120ccfab2b2ae267abbb3.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7075066.bat" "2⤵
- Deletes itself
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ipv6srvs1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7075066.batFilesize
239B
MD5e79295a8ba3543bf6d83f719f04cecf5
SHA16d8b90be415574cf4595c85b37f893a7f3db43e7
SHA256a607d3b4eba492ee3b5ffe3aac905cbd630d941c030fb708564e1785c6b245b3
SHA5120031bd4e5f2406fbe4b40bfd1ed02f4dd6fe2e5399e518e522fc5e6259bd66103895cd85fac57c365aa78dde1b702f172f99d4e5494134c59193a821af0008a4
-
\??\c:\windows\ipv6netbrowssvc.dllFilesize
122KB
MD5f5c0cd8596067d010931807fe58b12b2
SHA141b1683201e8d2b8d75f373f70dfbe8da9a23c5d
SHA256dad6637987c41070b47175704fc4994f25bae0d6e7614dbc032ffc08d2eb5725
SHA512d824978060bfdadd7feb95b81d033599efadd034283d5cb464afeb546292043323d003ef51ad50910444e80988e9911b3a2eb8dacb2e9b007a1555d5a7c688c4
-
memory/832-54-0x0000000000E31000-0x0000000000E34000-memory.dmpFilesize
12KB
-
memory/832-56-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/832-59-0x0000000000E30000-0x0000000000E6E000-memory.dmpFilesize
248KB
-
memory/1240-57-0x00000000755E1000-0x00000000755E4000-memory.dmpFilesize
12KB
-
memory/1240-61-0x00000000755E0000-0x000000007561E000-memory.dmpFilesize
248KB
-
memory/1240-62-0x00000000755E0000-0x000000007561E000-memory.dmpFilesize
248KB
-
memory/1976-58-0x0000000000000000-mapping.dmp