Analysis
-
max time kernel
150s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 23:49
Static task
static1
Behavioral task
behavioral1
Sample
5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe
-
Size
156KB
-
MD5
085229e202e2dd247fc008a3024e3627
-
SHA1
5e0e6f1cb26fcebf1727a599c480e5702ea4f473
-
SHA256
5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57
-
SHA512
f2ee5dcd9dbc445af9c62026d8ea293c968e00292e392ee735bba2410d4e6fc7bc2ebcaf0ac92409f4dddd03c5f97ce6943bb5f577eed200386474693145232b
-
SSDEEP
3072:QBd15E2MtU7Qv0w4ZRRQMMDwtIMCeFP4ANA4oQZiEMnL:SdnE2R7Qvb4tQTaCeFP4A+WqL
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sfnic.exe -
Executes dropped EXE 1 IoCs
pid Process 2000 sfnic.exe -
Loads dropped DLL 2 IoCs
pid Process 1960 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe 1960 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /m" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /G" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /u" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /x" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /n" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /C" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /h" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /R" 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /F" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /Q" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /B" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /r" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /g" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /Y" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /y" sfnic.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /z" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /w" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /Z" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /U" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /a" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /e" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /X" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /q" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /A" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /W" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /d" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /E" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /i" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /R" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /M" sfnic.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /H" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /T" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /t" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /V" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /b" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /D" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /o" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /S" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /k" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /f" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /O" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /l" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /c" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /s" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /p" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /j" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /v" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /L" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /K" sfnic.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfnic = "C:\\Users\\Admin\\sfnic.exe /J" sfnic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1960 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe 2000 sfnic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1960 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe 2000 sfnic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2000 1960 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe 26 PID 1960 wrote to memory of 2000 1960 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe 26 PID 1960 wrote to memory of 2000 1960 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe 26 PID 1960 wrote to memory of 2000 1960 5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe"C:\Users\Admin\AppData\Local\Temp\5c70ea5abce68ee05eaeafdd7bca4cd535024f79c143ea1df83b99e6d08feb57.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\sfnic.exe"C:\Users\Admin\sfnic.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2000
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5ed8bb2a99f20a1a4ea87a19d5de874b8
SHA15a5f09aa6c6ab730c287b2ea637738067c1118c7
SHA25611b0876d312d1ac3dbb64a5670822faf22712d101b1edde2ba8f788888de4a28
SHA512f785406661b74465539e5b0bd4006ffb0a7fe1cd631ae6835e13d851dbcf887c14d592620d7de8081d9e5e51f947bf2a8eb1113734250d0f6f2cd488b375f5d6
-
Filesize
156KB
MD5ed8bb2a99f20a1a4ea87a19d5de874b8
SHA15a5f09aa6c6ab730c287b2ea637738067c1118c7
SHA25611b0876d312d1ac3dbb64a5670822faf22712d101b1edde2ba8f788888de4a28
SHA512f785406661b74465539e5b0bd4006ffb0a7fe1cd631ae6835e13d851dbcf887c14d592620d7de8081d9e5e51f947bf2a8eb1113734250d0f6f2cd488b375f5d6
-
Filesize
156KB
MD5ed8bb2a99f20a1a4ea87a19d5de874b8
SHA15a5f09aa6c6ab730c287b2ea637738067c1118c7
SHA25611b0876d312d1ac3dbb64a5670822faf22712d101b1edde2ba8f788888de4a28
SHA512f785406661b74465539e5b0bd4006ffb0a7fe1cd631ae6835e13d851dbcf887c14d592620d7de8081d9e5e51f947bf2a8eb1113734250d0f6f2cd488b375f5d6
-
Filesize
156KB
MD5ed8bb2a99f20a1a4ea87a19d5de874b8
SHA15a5f09aa6c6ab730c287b2ea637738067c1118c7
SHA25611b0876d312d1ac3dbb64a5670822faf22712d101b1edde2ba8f788888de4a28
SHA512f785406661b74465539e5b0bd4006ffb0a7fe1cd631ae6835e13d851dbcf887c14d592620d7de8081d9e5e51f947bf2a8eb1113734250d0f6f2cd488b375f5d6