Analysis

  • max time kernel
    110s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2022 14:24

General

  • Target

    f8a9f83713405e179d30d6b04133e225741c85381151b9c2455e24d19beb749f.exe

  • Size

    566KB

  • MD5

    519326c59b148171f46535c4dc22dc76

  • SHA1

    6faec1ae10c597455ff6768425c3c57aa31fd855

  • SHA256

    f8a9f83713405e179d30d6b04133e225741c85381151b9c2455e24d19beb749f

  • SHA512

    6ba4e65739617f2d174bb3bd840ca8d81e1d5cfc4e6849d876a281f01c78ac5a20e22132542f1c0b7dc20e6be24495cdca623121a4a2c410be9f48fefdade903

  • SSDEEP

    12288:e0nyfXuIBDtfuRhKzh5jOZ03O21JDM7eAc/cIkj1LJ+Ul5yxWA9:rny/f9uRhKzT53Bhhkj1LyD

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8a9f83713405e179d30d6b04133e225741c85381151b9c2455e24d19beb749f.exe
    "C:\Users\Admin\AppData\Local\Temp\f8a9f83713405e179d30d6b04133e225741c85381151b9c2455e24d19beb749f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ixwx\8ry0s.vbs"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe
        "C:\Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 && move C:\tdEMCEtdEMCE\tdEMCE.vbs "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdEMCE.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:436
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              6⤵
              • Runs ping.exe
              PID:1660
          • C:\Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe
            "C:\Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1928
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=p3suy.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1824
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:275457 /prefetch:2
                7⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7ixwx\8ry0s.vbs
    Filesize

    100B

    MD5

    fab804804f7f0ee8008795292b55673a

    SHA1

    7213d8934e66c07afb233abb01d3f99de5a866a8

    SHA256

    9314f99fbfc97acdbee1ffa8e5e76f9c8a682f074affb0279e3d394762f08888

    SHA512

    95bf8c806dab70b8ddd7f92a9d76d099fa333e2f7c461f9c3a8cf0ada3e384b734115f96d5642a0100155478f0170a390dce408abe5b7b5d8f8be3b921527842

  • C:\Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe
    Filesize

    89KB

    MD5

    88bed359ac934343068b3ebae772d28b

    SHA1

    e7f28a4e2c2650dc14e670ddf71a9fc6738c7a9e

    SHA256

    c4aa98dbeb6afcf1a41eef2da74d1a89ba8d5bfb4c54bec36b7c8e2dbfdbfa78

    SHA512

    b299ce888e8121d689877cb419a5b31cbb3073a1808b53c2b60ed628b691be9bc5af2e6c5858a4a18374d785c57cffb2ee13cc9a295e298176810375dea07af7

  • C:\Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe
    Filesize

    89KB

    MD5

    88bed359ac934343068b3ebae772d28b

    SHA1

    e7f28a4e2c2650dc14e670ddf71a9fc6738c7a9e

    SHA256

    c4aa98dbeb6afcf1a41eef2da74d1a89ba8d5bfb4c54bec36b7c8e2dbfdbfa78

    SHA512

    b299ce888e8121d689877cb419a5b31cbb3073a1808b53c2b60ed628b691be9bc5af2e6c5858a4a18374d785c57cffb2ee13cc9a295e298176810375dea07af7

  • C:\Users\Admin\AppData\Local\Temp\7ixwx\x
    Filesize

    463KB

    MD5

    a9303dd438c71b6842e7482f6c0841c6

    SHA1

    f9284ecfecce37c41c71a39d8793b4b86e2e0ed7

    SHA256

    7a6761925987d87495cf05ba4418384f47f9b008be8ae482f982f8a7bbad4e31

    SHA512

    a65cbb2131d8347eda3293a87a3163548d555ae797a70cbe1ec601351604ffbdeb4e9ecab199a84fd0821063e3e34d1e165cffb3bd187372607135ad23c1b82d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QY94COXE.txt
    Filesize

    535B

    MD5

    dc2162caaf49ebad409cf4b30f42f31c

    SHA1

    2f4a73c1fc9896ce3e7bda81ef8ee6f112c84d0d

    SHA256

    e29b965625d2eb3dbf6de77a2a072973267263d51001dbc25d61b491b3a8837b

    SHA512

    b3d40a53ca91ae41b185e84c206b04a76a4f507c98f672817c5e8339410ad966e9bbfb38b60f071a124e42ab2627bdd69a87555e619942b8fb809ca323e70d3f

  • C:\tdEMCEtdEMCE\tdEMCE.vbs
    Filesize

    207B

    MD5

    5cfe2691be4c514bd2bf079484b31584

    SHA1

    fcbe88bb9f5cbb40386beb93999940f0223b7177

    SHA256

    909e76547a44b47c5d562f3cc9e1d086530499911472137f1b7059f6870084f6

    SHA512

    b6d8855fd951561550d40fd36ff903d9ad5b37ae4adc85cdb4332bbf227a091460064b21af238b8f2a1e48a90af71a37efa50c234d016e5b83c0fc17f9717609

  • \Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe
    Filesize

    89KB

    MD5

    88bed359ac934343068b3ebae772d28b

    SHA1

    e7f28a4e2c2650dc14e670ddf71a9fc6738c7a9e

    SHA256

    c4aa98dbeb6afcf1a41eef2da74d1a89ba8d5bfb4c54bec36b7c8e2dbfdbfa78

    SHA512

    b299ce888e8121d689877cb419a5b31cbb3073a1808b53c2b60ed628b691be9bc5af2e6c5858a4a18374d785c57cffb2ee13cc9a295e298176810375dea07af7

  • \Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe
    Filesize

    89KB

    MD5

    88bed359ac934343068b3ebae772d28b

    SHA1

    e7f28a4e2c2650dc14e670ddf71a9fc6738c7a9e

    SHA256

    c4aa98dbeb6afcf1a41eef2da74d1a89ba8d5bfb4c54bec36b7c8e2dbfdbfa78

    SHA512

    b299ce888e8121d689877cb419a5b31cbb3073a1808b53c2b60ed628b691be9bc5af2e6c5858a4a18374d785c57cffb2ee13cc9a295e298176810375dea07af7

  • \Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe
    Filesize

    89KB

    MD5

    88bed359ac934343068b3ebae772d28b

    SHA1

    e7f28a4e2c2650dc14e670ddf71a9fc6738c7a9e

    SHA256

    c4aa98dbeb6afcf1a41eef2da74d1a89ba8d5bfb4c54bec36b7c8e2dbfdbfa78

    SHA512

    b299ce888e8121d689877cb419a5b31cbb3073a1808b53c2b60ed628b691be9bc5af2e6c5858a4a18374d785c57cffb2ee13cc9a295e298176810375dea07af7

  • \Users\Admin\AppData\Local\Temp\7ixwx\p3suy.exe
    Filesize

    89KB

    MD5

    88bed359ac934343068b3ebae772d28b

    SHA1

    e7f28a4e2c2650dc14e670ddf71a9fc6738c7a9e

    SHA256

    c4aa98dbeb6afcf1a41eef2da74d1a89ba8d5bfb4c54bec36b7c8e2dbfdbfa78

    SHA512

    b299ce888e8121d689877cb419a5b31cbb3073a1808b53c2b60ed628b691be9bc5af2e6c5858a4a18374d785c57cffb2ee13cc9a295e298176810375dea07af7

  • memory/436-79-0x0000000000000000-mapping.dmp
  • memory/952-55-0x0000000000000000-mapping.dmp
  • memory/1212-61-0x0000000000000000-mapping.dmp
  • memory/1360-54-0x00000000751A1000-0x00000000751A3000-memory.dmp
    Filesize

    8KB

  • memory/1508-76-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-66-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-73-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-77-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-78-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-70-0x0000000000415660-mapping.dmp
  • memory/1508-65-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-69-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-68-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-75-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1508-94-0x0000000000400000-0x0000000000417000-memory.dmp
    Filesize

    92KB

  • memory/1660-81-0x0000000000000000-mapping.dmp
  • memory/1928-87-0x0000000000400000-0x0000000000444000-memory.dmp
    Filesize

    272KB

  • memory/1928-89-0x0000000000400000-0x0000000000444000-memory.dmp
    Filesize

    272KB

  • memory/1928-91-0x0000000000400000-0x0000000000444000-memory.dmp
    Filesize

    272KB

  • memory/1928-92-0x000000000043F8BE-mapping.dmp
  • memory/1928-95-0x0000000000402000-0x000000000043FA00-memory.dmp
    Filesize

    246KB

  • memory/1928-86-0x0000000000400000-0x0000000000444000-memory.dmp
    Filesize

    272KB

  • memory/1928-96-0x0000000000402000-0x000000000043FA00-memory.dmp
    Filesize

    246KB