Analysis
-
max time kernel
151s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 16:09
Static task
static1
Behavioral task
behavioral1
Sample
e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
-
Size
481KB
-
MD5
b9b314fc245634b5230eea2736c24959
-
SHA1
1ef8f02c5a60a70d88b79d263a1646b4c9ef9815
-
SHA256
e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
-
SHA512
dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8
-
SSDEEP
6144:JXjbNpPRMx8hU9K+SRhj+dBsWHuKCRnNrMmv1IH/V0MgraPWGuLfcwSpb1H78i+L:+NikBsKPVZwa+2J7p55UbEy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe -
Deletes itself 1 IoCs
pid Process 1896 cmd.exe -
Loads dropped DLL 3 IoCs
pid Process 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 644 taskmgr.exe 644 taskmgr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\system2.exe" e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\system2.exe" e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1940 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe Token: SeDebugPrivilege 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe Token: SeDebugPrivilege 644 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe 644 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1980 wrote to memory of 956 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 28 PID 1980 wrote to memory of 956 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 28 PID 1980 wrote to memory of 956 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 28 PID 1980 wrote to memory of 956 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 28 PID 1980 wrote to memory of 1896 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 30 PID 1980 wrote to memory of 1896 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 30 PID 1980 wrote to memory of 1896 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 30 PID 1980 wrote to memory of 1896 1980 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 30 PID 956 wrote to memory of 644 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 29 PID 956 wrote to memory of 644 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 29 PID 956 wrote to memory of 644 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 29 PID 956 wrote to memory of 644 956 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 29 PID 1896 wrote to memory of 1940 1896 cmd.exe 32 PID 1896 wrote to memory of 1940 1896 cmd.exe 32 PID 1896 wrote to memory of 1940 1896 cmd.exe 32 PID 1896 wrote to memory of 1940 1896 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:644
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:1940
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Filesize481KB
MD5b9b314fc245634b5230eea2736c24959
SHA11ef8f02c5a60a70d88b79d263a1646b4c9ef9815
SHA256e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
SHA512dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8
-
C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Filesize481KB
MD5b9b314fc245634b5230eea2736c24959
SHA11ef8f02c5a60a70d88b79d263a1646b4c9ef9815
SHA256e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
SHA512dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8
-
\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Filesize481KB
MD5b9b314fc245634b5230eea2736c24959
SHA11ef8f02c5a60a70d88b79d263a1646b4c9ef9815
SHA256e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
SHA512dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8
-
\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Filesize481KB
MD5b9b314fc245634b5230eea2736c24959
SHA11ef8f02c5a60a70d88b79d263a1646b4c9ef9815
SHA256e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
SHA512dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8
-
\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Filesize481KB
MD5b9b314fc245634b5230eea2736c24959
SHA11ef8f02c5a60a70d88b79d263a1646b4c9ef9815
SHA256e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
SHA512dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8