Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 18:38
Static task
static1
Behavioral task
behavioral1
Sample
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe
Resource
win10v2004-20221111-en
General
-
Target
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe
-
Size
43KB
-
MD5
3ff1d4d90089b7b85a311d36dd65df90
-
SHA1
ac9c6c488afb359abc4035ea448c3daed0e09247
-
SHA256
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9
-
SHA512
bda7bff84fa0c43c437dd1c9d677194672a00e33e5d171b77b520765d624773f03d772612dffef6b27f9f9b4dd12b1729e2a0e783455b2f531d3036ad10ae383
-
SSDEEP
768:OoJZf8+T6hhSEs2bArq92T62oz5c1+6HPjH/Qqvtu1C+V2r1afAGclevNU3QUvmF:RG27dPTPKhyafABlevtHCCrk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid process 1788 Windows.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Windows.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\55b3825ee39ada2fcddf7c7accbde69e.exe Windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\55b3825ee39ada2fcddf7c7accbde69e.exe Windows.exe -
Loads dropped DLL 1 IoCs
Processes:
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exepid process 752 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Windows.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\55b3825ee39ada2fcddf7c7accbde69e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\55b3825ee39ada2fcddf7c7accbde69e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." Windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Windows.exepid process 1788 Windows.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Windows.exedescription pid process Token: SeDebugPrivilege 1788 Windows.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exeWindows.exedescription pid process target process PID 752 wrote to memory of 1788 752 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe Windows.exe PID 752 wrote to memory of 1788 752 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe Windows.exe PID 752 wrote to memory of 1788 752 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe Windows.exe PID 752 wrote to memory of 1788 752 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe Windows.exe PID 1788 wrote to memory of 2000 1788 Windows.exe netsh.exe PID 1788 wrote to memory of 2000 1788 Windows.exe netsh.exe PID 1788 wrote to memory of 2000 1788 Windows.exe netsh.exe PID 1788 wrote to memory of 2000 1788 Windows.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe"C:\Users\Admin\AppData\Local\Temp\767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Windows.exe"C:\Users\Admin\AppData\Local\Temp\Windows.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Windows.exe" "Windows.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Windows.exeFilesize
43KB
MD53ff1d4d90089b7b85a311d36dd65df90
SHA1ac9c6c488afb359abc4035ea448c3daed0e09247
SHA256767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9
SHA512bda7bff84fa0c43c437dd1c9d677194672a00e33e5d171b77b520765d624773f03d772612dffef6b27f9f9b4dd12b1729e2a0e783455b2f531d3036ad10ae383
-
C:\Users\Admin\AppData\Local\Temp\Windows.exeFilesize
43KB
MD53ff1d4d90089b7b85a311d36dd65df90
SHA1ac9c6c488afb359abc4035ea448c3daed0e09247
SHA256767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9
SHA512bda7bff84fa0c43c437dd1c9d677194672a00e33e5d171b77b520765d624773f03d772612dffef6b27f9f9b4dd12b1729e2a0e783455b2f531d3036ad10ae383
-
\Users\Admin\AppData\Local\Temp\Windows.exeFilesize
43KB
MD53ff1d4d90089b7b85a311d36dd65df90
SHA1ac9c6c488afb359abc4035ea448c3daed0e09247
SHA256767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9
SHA512bda7bff84fa0c43c437dd1c9d677194672a00e33e5d171b77b520765d624773f03d772612dffef6b27f9f9b4dd12b1729e2a0e783455b2f531d3036ad10ae383
-
memory/752-54-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB
-
memory/752-61-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1788-56-0x0000000000000000-mapping.dmp
-
memory/1788-62-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1788-64-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/2000-60-0x0000000000000000-mapping.dmp