Analysis
-
max time kernel
217s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 15:39
Static task
static1
Behavioral task
behavioral1
Sample
8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe
Resource
win10v2004-20221111-en
General
-
Target
8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe
-
Size
168KB
-
MD5
8e4be2eb83b42225b500ca568d023e9a
-
SHA1
8ea1f7cd198e9d6c6567444fffd1f0af0f1753f3
-
SHA256
8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d
-
SHA512
c809d76695b8aad93e6785af453d13ae8ad6f19af175efd134685538c41cab069c8b92ee1b3a210fe31efea067639e68f1a925527cdbd4fedfdb1069eb33c2b3
-
SSDEEP
3072:5v9cbTFhDHGrwpfwtTsZVQ3zY54tyeh8ZtkEqXJzRzaLrt:5Fcbhhb3p8TAQ3zY54tpqZtkEqZc
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1044 cmd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2020 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exepid process 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exenet.exenet.execmd.execmd.exenet.exedescription pid process target process PID 772 wrote to memory of 940 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe net.exe PID 772 wrote to memory of 940 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe net.exe PID 772 wrote to memory of 940 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe net.exe PID 772 wrote to memory of 940 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe net.exe PID 940 wrote to memory of 704 940 net.exe net1.exe PID 940 wrote to memory of 704 940 net.exe net1.exe PID 940 wrote to memory of 704 940 net.exe net1.exe PID 940 wrote to memory of 704 940 net.exe net1.exe PID 772 wrote to memory of 1836 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe net.exe PID 772 wrote to memory of 1836 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe net.exe PID 772 wrote to memory of 1836 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe net.exe PID 772 wrote to memory of 1836 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe net.exe PID 1836 wrote to memory of 1740 1836 net.exe net1.exe PID 1836 wrote to memory of 1740 1836 net.exe net1.exe PID 1836 wrote to memory of 1740 1836 net.exe net1.exe PID 1836 wrote to memory of 1740 1836 net.exe net1.exe PID 772 wrote to memory of 1280 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 1280 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 1280 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 1280 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 556 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 556 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 556 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 556 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 1280 wrote to memory of 388 1280 cmd.exe net.exe PID 1280 wrote to memory of 388 1280 cmd.exe net.exe PID 1280 wrote to memory of 388 1280 cmd.exe net.exe PID 1280 wrote to memory of 388 1280 cmd.exe net.exe PID 556 wrote to memory of 2020 556 cmd.exe sc.exe PID 556 wrote to memory of 2020 556 cmd.exe sc.exe PID 556 wrote to memory of 2020 556 cmd.exe sc.exe PID 556 wrote to memory of 2020 556 cmd.exe sc.exe PID 388 wrote to memory of 432 388 net.exe net1.exe PID 388 wrote to memory of 432 388 net.exe net1.exe PID 388 wrote to memory of 432 388 net.exe net1.exe PID 388 wrote to memory of 432 388 net.exe net1.exe PID 772 wrote to memory of 1044 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 1044 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 1044 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe PID 772 wrote to memory of 1044 772 8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe"C:\Users\Admin\AppData\Local\Temp\8235712093c3d4d8e6ace925ce65654bb6d68673cfcfb8f3808f40b67bbdf65d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet group /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 group /domain3⤵
-
C:\Windows\SysWOW64\net.exenet group /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 group /domain3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C net.exe stop foundation2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet.exe stop foundation3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop foundation4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete foundation2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete foundation3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\823571~1.EXE >> NUL2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-62-0x0000000000000000-mapping.dmp
-
memory/432-64-0x0000000000000000-mapping.dmp
-
memory/556-61-0x0000000000000000-mapping.dmp
-
memory/704-56-0x0000000000000000-mapping.dmp
-
memory/772-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/772-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/772-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/772-54-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/940-55-0x0000000000000000-mapping.dmp
-
memory/1044-66-0x0000000000000000-mapping.dmp
-
memory/1280-60-0x0000000000000000-mapping.dmp
-
memory/1740-58-0x0000000000000000-mapping.dmp
-
memory/1836-57-0x0000000000000000-mapping.dmp
-
memory/2020-63-0x0000000000000000-mapping.dmp