f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac

Analysis

max time kernel
40s
max time network
65s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Size

72KB
MD5

5650bade2fcab78cce50b012a68bcf35
SHA1

24b6ca5cab1f0a14c361ef65ac4009c52399886f
SHA256

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac
SHA512

60c182baaedfa043dbd1219ef5740a376e44985e21e38e557c4bfbace015be95f3b083839bef8a8d6e54bfda3cf42be718822af6641947024c771edfe65eadd4
SSDEEP

1536:vdQ3Lwcn5gp+kj/z/xWiktzEhnPO3F8Jxta3XigpzYwhnmNLF:FOLwcnoj/z/xWikNEhG3F8ha3ygpUGn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 368	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	5
PID 624 wrote to memory of 368	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	5
PID 624 wrote to memory of 368	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	5
PID 624 wrote to memory of 368	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	5
PID 624 wrote to memory of 368	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	5
PID 624 wrote to memory of 368	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	5
PID 624 wrote to memory of 368	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	5
PID 624 wrote to memory of 380	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	4
PID 624 wrote to memory of 380	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	4
PID 624 wrote to memory of 380	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	4
PID 624 wrote to memory of 380	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	4
PID 624 wrote to memory of 380	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	4
PID 624 wrote to memory of 380	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	4
PID 624 wrote to memory of 380	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	4
PID 624 wrote to memory of 416	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 624 wrote to memory of 416	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 624 wrote to memory of 416	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 624 wrote to memory of 416	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 624 wrote to memory of 416	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 624 wrote to memory of 416	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 624 wrote to memory of 416	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 624 wrote to memory of 460	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	2
PID 624 wrote to memory of 460	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	2
PID 624 wrote to memory of 460	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	2
PID 624 wrote to memory of 460	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	2
PID 624 wrote to memory of 460	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	2
PID 624 wrote to memory of 460	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	2
PID 624 wrote to memory of 460	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	2
PID 624 wrote to memory of 476	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 624 wrote to memory of 476	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 624 wrote to memory of 476	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 624 wrote to memory of 476	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 624 wrote to memory of 476	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 624 wrote to memory of 476	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 624 wrote to memory of 476	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 624 wrote to memory of 484	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	26
PID 624 wrote to memory of 484	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	26
PID 624 wrote to memory of 484	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	26
PID 624 wrote to memory of 484	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	26
PID 624 wrote to memory of 484	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	26
PID 624 wrote to memory of 484	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	26
PID 624 wrote to memory of 484	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	26
PID 624 wrote to memory of 596	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	25
PID 624 wrote to memory of 596	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	25
PID 624 wrote to memory of 596	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	25
PID 624 wrote to memory of 596	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	25
PID 624 wrote to memory of 596	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	25
PID 624 wrote to memory of 596	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	25
PID 624 wrote to memory of 596	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	25
PID 624 wrote to memory of 676	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	24
PID 624 wrote to memory of 676	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	24
PID 624 wrote to memory of 676	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	24
PID 624 wrote to memory of 676	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	24
PID 624 wrote to memory of 676	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	24
PID 624 wrote to memory of 676	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	24
PID 624 wrote to memory of 676	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	24
PID 624 wrote to memory of 760	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	23
PID 624 wrote to memory of 760	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	23
PID 624 wrote to memory of 760	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	23
PID 624 wrote to memory of 760	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	23
PID 624 wrote to memory of 760	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	23
PID 624 wrote to memory of 760	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	23
PID 624 wrote to memory of 760	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	23
PID 624 wrote to memory of 812	624	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	22

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1080
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1112
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1148
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1048
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1012
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:284
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:884
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:840
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:760
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:852

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1996

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Users\Admin\AppData\Local\Temp\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
  "C:\Users\Admin\AppData\Local\Temp\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:624

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/624-55-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download
memory/624-56-0x0000000074DB1000-0x0000000074DB3000-memory.dmp

Filesize
8KB

Download
memory/624-57-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download