Analysis

  • max time kernel
    38s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28/11/2022, 02:21

General

  • Target

    ad712186ec7c840ab58e058280308ac1a9f5987d2ad78438a66b526854d7ee58.exe

  • Size

    559KB

  • MD5

    16264740711851f18820769a1de5be7b

  • SHA1

    136513c31990a238269da93fa47be668c67b1f5f

  • SHA256

    ad712186ec7c840ab58e058280308ac1a9f5987d2ad78438a66b526854d7ee58

  • SHA512

    ccf657771a1c94f0bd6cf8be4423ef86aedb5ad1dbe8cdd99e7bc78dcc483a559c309fcd7ea9d4f663f1e47f51e5cae3e2fa79209178e6ea24957a4720fb7001

  • SSDEEP

    12288:LgMPmbebtASMs3V+EkdARMnts1I/lOMscF2+Igh6/wUWtGo:Llu3SMmodARMtyI/lDs4mwU

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad712186ec7c840ab58e058280308ac1a9f5987d2ad78438a66b526854d7ee58.exe
    "C:\Users\Admin\AppData\Local\Temp\ad712186ec7c840ab58e058280308ac1a9f5987d2ad78438a66b526854d7ee58.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\babicabebbcab.exe
      C:\Users\Admin\AppData\Local\Temp\babicabebbcab.exe /PID=0 /SUBPID=0 /NETWORKID=0 /DISTID=0 /CID=0 /PRODUCT_ID=0 /SERVER_URL=`omn7).`ip`[o're_,]pnn%ok_`e-_ok /CLICKID= /D1=-1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /THANKYOU_URL= /TIME=1413608621 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /HIDEX=1 /IS_DYNAMIC_ENCRYPTED=true
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\91669702249.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1440
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\91669702249.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1812
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\91669702249.txt bios get version
        3⤵
          PID:1772
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\91669702249.txt bios get version
          3⤵
            PID:1508
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\91669702249.txt bios get version
            3⤵
              PID:896
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 368
              3⤵
              • Loads dropped DLL
              • Program crash
              PID:2016

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\91669702249.txt

          Filesize

          66B

          MD5

          9025468f85256136f923096b01375964

          SHA1

          7fcd174999661594fa5f88890ffb195e9858cc52

          SHA256

          d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

          SHA512

          92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

        • C:\Users\Admin\AppData\Local\Temp\91669702249.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\91669702249.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\91669702249.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\91669702249.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\babicabebbcab.exe

          Filesize

          792KB

          MD5

          3059b481ab5603b7af0d487e3c0efa48

          SHA1

          6c409a89973c610111e465c6df0e4d0dabf42b87

          SHA256

          6813cc5984e37c6615d6021a17f780ee6ee8dddc277b088f06b739941c80c0fa

          SHA512

          22a016f847039b4f49692996243c02c7eb27ef4fa9e87d7528467db6337fc7888cc4080978725c7f5e744c25b9f1b03818b188cfe69fc476d54719766fe65e1c

        • \Users\Admin\AppData\Local\Temp\nst259C.tmp\nsisunz.dll

          Filesize

          40KB

          MD5

          5f13dbc378792f23e598079fc1e4422b

          SHA1

          5813c05802f15930aa860b8363af2b58426c8adf

          SHA256

          6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

          SHA512

          9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

        • \Users\Admin\AppData\Local\Temp\nst259C.tmp\zzde.dll

          Filesize

          113KB

          MD5

          1801ef8660d57b65a56b6cda3d116ef2

          SHA1

          c0bf938966497c90d1be5447e717371f05ef6f59

          SHA256

          bb36d4189f88bc75486e8f941bea779c28bc5a79bb2062d7e0c48337e1f506f2

          SHA512

          6e572c6b034dd639eb45fb8d54a65fb42bbe119af5dd41c1133c005c18a537f09c252da452e3409d755658b1db4820fa718c61d9b491e497b2341fa05155ea61

        • memory/1476-54-0x0000000075E51000-0x0000000075E53000-memory.dmp

          Filesize

          8KB