Overview

overview

8

Static

static

8

7527a50b6e...80.exe

windows7-x64

8

7527a50b6e...80.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7527a50b6ef804b59d1dada0943fd08be9afb23d3a06c24d5d7c53ce41999980.exe

  • Size

    41KB

  • MD5

    dd80c4327e66f773a10e4b498607e138

  • SHA1

    de051b56c19ee66b57a858e202babb4697887713

  • SHA256

    7527a50b6ef804b59d1dada0943fd08be9afb23d3a06c24d5d7c53ce41999980

  • SHA512

    8fa7b214c117a59d766f893ab986bf1cbb5cc8525f9ae0f6b810f84d2538ab5e56ed7601148f84a5849ca5873da43263e1c7442afce785115ca6ec78ab6c5043

  • SSDEEP

    768:BLFtPxgh6ySO6zYxrbRlkRMDyzn99s0503LY5fCJEgtsxjKppBdsZUf:B5tPxagOCkD7DQnQ0503jsxjKpuKf

Score
8/10
evasionupx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Stops running service(s) 3 TTPs
    evasion
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7527a50b6ef804b59d1dada0943fd08be9afb23d3a06c24d5d7c53ce41999980.exe
    "C:\Users\Admin\AppData\Local\Temp\7527a50b6ef804b59d1dada0943fd08be9afb23d3a06c24d5d7c53ce41999980.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" import C:\Windows\323.mp3
      2⤵
        PID:1888
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" config PolicyAgent start= auto
        2⤵
        • Launches sc.exe
        PID:1496
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" stop PolicyAgent
        2⤵
        • Launches sc.exe
        PID:624
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" start PolicyAgent
        2⤵
        • Launches sc.exe
        PID:1100
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" stop PolicyAgent
        2⤵
        • Launches sc.exe
        PID:1876
      • C:\Users\Admin\AppData\Local\Temp\7124238cba.exe
        "C:\Users\Admin\AppData\Local\Temp\7124238cba.exe"
        2⤵
        • Executes dropped EXE
        PID:1616
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:920

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\7124238cba.exe
            Filesize

            15KB

            MD5

            cfb7d99a3a9604f7bbe85c5b56852324

            SHA1

            c16009ef9c61baf4cc260d97a4c7021293c6cd29

            SHA256

            9765b60f920154b5ef54051b6e2640978e1b75377bd6a407d4e57fd5b75208f9

            SHA512

            be055baa50f9cb79d0274dbcc2f05983281b9653b794eb286917c35ae2f7b7763825c5ef87d89d7bf54a050576fe05ca0342e9ba56a21a226b7a3672a58d755a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\7124238cba.exe
            Filesize

            15KB

            MD5

            cfb7d99a3a9604f7bbe85c5b56852324

            SHA1

            c16009ef9c61baf4cc260d97a4c7021293c6cd29

            SHA256

            9765b60f920154b5ef54051b6e2640978e1b75377bd6a407d4e57fd5b75208f9

            SHA512

            be055baa50f9cb79d0274dbcc2f05983281b9653b794eb286917c35ae2f7b7763825c5ef87d89d7bf54a050576fe05ca0342e9ba56a21a226b7a3672a58d755a

            Download Submit

          • C:\Windows\323.mp3
            Filesize

            56KB

            MD5

            bc8025bc98da7f4ed891c9f9991d3ff1

            SHA1

            70a69a7fcebe9b43f00a1fa713e3a0621bf3ac6d

            SHA256

            59b9dc39d69f8b0aa350f550e42e632b396237865776d0ce75477f8fe3f9016f

            SHA512

            7f772261e003d2df9162ae4aeaab2bda674ee2721b3300cc8b2a2f4904af6bc9c565c7f2c3e67a7394eb1a387860a2544fc5bdc3e6de384b664f8d232ad6acf5

            Download Submit

          • \PROGRA~1\Len0v0\One.dll
            Filesize

            10KB

            MD5

            b0e097256838fb16f979918102d13bb3

            SHA1

            1715a838b2b7e4f36424f06e16b543165d3d1792

            SHA256

            e2aa94cb988562c24f261927c1dfcd8e5139f570115abb6ef8f1cce37cc2a4e1

            SHA512

            82a7c493737e79277027132ebb6cba39a9cf7d488dad3e768fd10074eabc9454dd977a3e8a6882ddaf4b46c558d48f2a14f399a63ae8c824bf245efe1c322495

            Download Submit

          • \Users\Admin\AppData\Local\Temp\7124238cba.exe
            Filesize

            15KB

            MD5

            cfb7d99a3a9604f7bbe85c5b56852324

            SHA1

            c16009ef9c61baf4cc260d97a4c7021293c6cd29

            SHA256

            9765b60f920154b5ef54051b6e2640978e1b75377bd6a407d4e57fd5b75208f9

            SHA512

            be055baa50f9cb79d0274dbcc2f05983281b9653b794eb286917c35ae2f7b7763825c5ef87d89d7bf54a050576fe05ca0342e9ba56a21a226b7a3672a58d755a

            Download Submit

          • \Users\Admin\AppData\Local\Temp\7124238cba.exe
            Filesize

            15KB

            MD5

            cfb7d99a3a9604f7bbe85c5b56852324

            SHA1

            c16009ef9c61baf4cc260d97a4c7021293c6cd29

            SHA256

            9765b60f920154b5ef54051b6e2640978e1b75377bd6a407d4e57fd5b75208f9

            SHA512

            be055baa50f9cb79d0274dbcc2f05983281b9653b794eb286917c35ae2f7b7763825c5ef87d89d7bf54a050576fe05ca0342e9ba56a21a226b7a3672a58d755a

            Download Submit

          • \Windows\SysWOW64\kdnfdb.dll
            Filesize

            16KB

            MD5

            add4832059173fcdb135d949194ad52b

            SHA1

            33f1dfd83e76e0897bd134d380fd56431a7cde6b

            SHA256

            2f9b075862a8509928a48c20bd988215c4f754d2ee3171cf15320ffe6f77f957

            SHA512

            ac04e7ec33592423a85dbcd0aa7a40e5e63671ad712101f007db8551be49b407c508e17d80fd3dcdece2a9d0a8cf9980aae5aa76e8452af73485fd62f31ad0d5

            Download Submit

          • memory/1280-66-0x00000000005C0000-0x00000000005C6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/1280-63-0x0000000010000000-0x0000000010005000-memory.dmp

            Filesize

            20KB

            Download

          • memory/1280-54-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

            Download

          • memory/1280-61-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

            Download

          • memory/1280-55-0x0000000075811000-0x0000000075813000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1280-72-0x00000000005C0000-0x00000000005C6000-memory.dmp

            Filesize

            24KB

            Download