Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 18:20
Static task
static1
Behavioral task
behavioral1
Sample
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe
Resource
win7-20220812-en
General
-
Target
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe
-
Size
679KB
-
MD5
6849594bb5bf5ef5c7dad7c530d6e9dc
-
SHA1
e067a1e42e718d561cd5a1d70b3cf7348e603947
-
SHA256
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e
-
SHA512
9ed5ae5e3123c37ccb75631c63b056e5531589aee823052877c05d972e8962644c55651a5202d669eef47932413f3ae939b7f3c020a2d325644dc38ee4ded46d
-
SSDEEP
12288:mK2mhAMJ/cPl5SIFhjHfZqp38h7UZYE82Y5UKUL4n4y3Xp3SbSlNHNU:H2O/Gl5rdfR7g6zwm4m53Sb2rU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
lidtjnltu.exepid process 944 lidtjnltu.exe -
Loads dropped DLL 4 IoCs
Processes:
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exepid process 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
lidtjnltu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\7XOG67~1 = "C:\\Users\\Admin\\7XOG67~1\\ymkus.vbs" lidtjnltu.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce lidtjnltu.exe -
Processes:
lidtjnltu.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lidtjnltu.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lidtjnltu.exedescription pid process target process PID 944 set thread context of 1360 944 lidtjnltu.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
lidtjnltu.exepid process 944 lidtjnltu.exe 944 lidtjnltu.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exelidtjnltu.exedescription pid process target process PID 1976 wrote to memory of 944 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 1976 wrote to memory of 944 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 1976 wrote to memory of 944 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 1976 wrote to memory of 944 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 1976 wrote to memory of 944 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 1976 wrote to memory of 944 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 1976 wrote to memory of 944 1976 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 944 wrote to memory of 1360 944 lidtjnltu.exe RegSvcs.exe PID 944 wrote to memory of 1360 944 lidtjnltu.exe RegSvcs.exe PID 944 wrote to memory of 1360 944 lidtjnltu.exe RegSvcs.exe PID 944 wrote to memory of 1360 944 lidtjnltu.exe RegSvcs.exe PID 944 wrote to memory of 1360 944 lidtjnltu.exe RegSvcs.exe PID 944 wrote to memory of 1360 944 lidtjnltu.exe RegSvcs.exe PID 944 wrote to memory of 1360 944 lidtjnltu.exe RegSvcs.exe PID 944 wrote to memory of 1360 944 lidtjnltu.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe"C:\Users\Admin\AppData\Local\Temp\37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\7xog675ium\lidtjnltu.exe"C:\Users\Admin\7xog675ium\lidtjnltu.exe" twbtpbuwce2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\7XOG67~1\VQHYER~1.KMAFilesize
81KB
MD5197a0ddebb03ba23a206474d3c4f2d3b
SHA1d4372c5184627be231613f062b63c34a9aa534ac
SHA256b012cd0baeb36d4b93fb8e4305243fbeda173ccb608e0dc6a9930662e6bdc825
SHA5123843439c2964837628947f3a3135de86bc52fd341dfe4f5490457177a7a8328cfcf7e852739b1740059c1c7e46540d2abeb9ae1ce94b2c8214674bd028a58fda
-
C:\Users\Admin\7XOG67~1\qmzpnx.GIHFilesize
87B
MD5dc51be2bbbcd55cf7fd8c1ae7bafd2e9
SHA15bb122092c88433bf62bafa6e9a9b1ce7eb75643
SHA2569658def8061ad1f0e2588e8e14c61c72b0daa42c5b8690628254a770d89d8330
SHA512659ed9d8447292d9b253a50b40fadf08dd31eb55f2a487d22a61e7ee63e2b8d5e8507eb342d0929996d89294f0b9527776319714fa0364fddce74e5ed72c01b7
-
C:\Users\Admin\7xog675ium\lidtjnltu.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\7xog675ium\twbtpbuwceFilesize
218.9MB
MD5b7fdf2bb72e48d9cf3542eceaac529bd
SHA140f6a3cbe519eef51d3f412b15fba63ad3240f93
SHA256f52effa7c36732c2daa21c6c90d9f4ab3b1086a4c33662e8da6b28ed284eda9c
SHA51285f1547138ee5c5cbf6979e28889801a2dcdc25969eabd47e91535abdba16d835f9138205a5a021d05595cda5d965b9ba49fed6d791cfbc72bcd1ee735c980db
-
\Users\Admin\7xog675ium\lidtjnltu.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\7xog675ium\lidtjnltu.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\7xog675ium\lidtjnltu.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\7xog675ium\lidtjnltu.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
memory/944-59-0x0000000000000000-mapping.dmp
-
memory/1360-66-0x0000000000402196-mapping.dmp
-
memory/1976-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmpFilesize
8KB