9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe
Size

21KB
MD5

3540216eede4028e26d3c0763c6b86a0
SHA1

332ed0f29ac483592dfe133211742005114d3249
SHA256

9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690
SHA512

99648b1b01532bc59d83fe08831ca98dcbdbfcc804e2354fd084059e09dd2be216bc52f26899cbb07de3a8729d61b6cd50ac295d66438db26106809ad1efb771
SSDEEP

384:BdEblyRygC3EneCVsTbH4x5x/xJsLhKgXMBuhFQss+9Xyyt:BdmNgC3THeVMKpBqFQA9b

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1556	vcflye.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000005c50-55.dat	upx
behavioral1/memory/1344-57-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/1556-58-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-61.dat	upx
behavioral1/memory/1556-62-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
944	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\vcflye.exe	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe
File created	C:\Windows\vcflye.exe	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe
Token: SeIncBasePriorityPrivilege	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1312	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe	27
PID 1344 wrote to memory of 1312	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe	27
PID 1344 wrote to memory of 1312	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe	27
PID 1344 wrote to memory of 1312	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe	27
PID 1344 wrote to memory of 944	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe	29
PID 1344 wrote to memory of 944	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe	29
PID 1344 wrote to memory of 944	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe	29
PID 1344 wrote to memory of 944	1344	9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe	29

C:\Users\Admin\AppData\Local\Temp\9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe
"C:\Users\Admin\AppData\Local\Temp\9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9D04BB~1.EXE > nul
  2⤵
  PID:1312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9D04BB~1.EXE > nul
  2⤵
  - Deletes itself
  PID:944

C:\Windows\vcflye.exe
C:\Windows\vcflye.exe
1⤵
- Executes dropped EXE
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\vcflye.exe

Filesize
21KB

MD5
3540216eede4028e26d3c0763c6b86a0

SHA1
332ed0f29ac483592dfe133211742005114d3249

SHA256
9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690

SHA512
99648b1b01532bc59d83fe08831ca98dcbdbfcc804e2354fd084059e09dd2be216bc52f26899cbb07de3a8729d61b6cd50ac295d66438db26106809ad1efb771

Download Submit
C:\Windows\vcflye.exe

Filesize
21KB

MD5
3540216eede4028e26d3c0763c6b86a0

SHA1
332ed0f29ac483592dfe133211742005114d3249

SHA256
9d04bb409c5e4cb5f762e8a29f7b8f1eb0d40ccf84a53ab567927d9fded71690

SHA512
99648b1b01532bc59d83fe08831ca98dcbdbfcc804e2354fd084059e09dd2be216bc52f26899cbb07de3a8729d61b6cd50ac295d66438db26106809ad1efb771

Download Submit
memory/944-60-0x0000000000000000-mapping.dmp

Download
memory/1312-59-0x0000000000000000-mapping.dmp

Download
memory/1344-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1344-57-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1556-58-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1556-62-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download