0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308

Analysis

max time kernel
183s
max time network
194s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe
Size

140KB
MD5

438320792e6dc8bccb6beeba01f4dd82
SHA1

40373fc465ef56c422c7a6745a9030150202e619
SHA256

0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308
SHA512

6a13589c647ca9b000ebf55856c42a8581fca0ba65dc0f87d4ef150724749be8232d78607fba345d6d514a8135bcd47052605ada6c563504b1e02973e71b1caa
SSDEEP

3072:lb4s/l8iiDXiYukRy9Vd746gh4Z91gCBzTz4y3/UHj7Nzspl+fXv:lB/l0Xi3uyJ7Mhy9dx3s3ff

Score

8^/10

persistence vmprotect

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceTestDos\Parameters\ServiceDll = "C:\\Windows\\ServiceTestDos.dll"	0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1004-54-0x0000000000BB0000-0x0000000000BF7000-memory.dmp	vmprotect
behavioral1/memory/1004-55-0x0000000000BB0000-0x0000000000BF7000-memory.dmp	vmprotect
behavioral1/files/0x000a00000001331d-56.dat	vmprotect
behavioral1/memory/1256-58-0x00000000750B0000-0x00000000750F7000-memory.dmp	vmprotect
behavioral1/memory/1256-59-0x00000000750B0000-0x00000000750F7000-memory.dmp	vmprotect

Deletes itself 1 IoCs

pid	Process
636	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceTestDos.dll	0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe
File opened for modification	C:\Windows\ServiceTestDos.dll	0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 636	1004	0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe	29
PID 1004 wrote to memory of 636	1004	0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe	29
PID 1004 wrote to memory of 636	1004	0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe	29
PID 1004 wrote to memory of 636	1004	0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe	29

C:\Users\Admin\AppData\Local\Temp\0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe
"C:\Users\Admin\AppData\Local\Temp\0522546519d4ec1efe7f947c291287db5219027476500c11a59984377c853308.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7125782.bat" "
  2⤵
  - Deletes itself
  PID:636

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k ServiceTestDos
1⤵
- Checks processor information in registry
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7125782.bat

Filesize
239B

MD5
97394993285e7d16fcadf93288659fbc

SHA1
7b639440d8fb4d2925d223cd3e8693e2fee19f29

SHA256
c824e32ec587d3695f1952b55da83d67a88c22feb8deafa688dd6452cf345c91

SHA512
9e5d21d23f94cb1bddc4aca41df9166f2f5a6d0bbb7edac078398d2577e39ddef6ce10076bb81653dc39b27ccd191e413d34bd7e2c8dcdf86d7c1b823b7b3a7e

Download Submit
\??\c:\windows\servicetestdos.dll

Filesize
140KB

MD5
3831fff43a1bcc807bf4669c1e352515

SHA1
ad9a5a0ec91e9675ca7c748ecafc9823b8a12d9a

SHA256
cc243035b16d0f86ea91c825043e90ac649b7f2eb749478ccac8581306b599a4

SHA512
b531a2145d8f0779252add2db60d1704e363b73525dcf759457a9cddc0fa2ee7c43403debb2f42527dd88e30b1f07d97c46010482e836aef444abe513818fe25

Download Submit
memory/1004-54-0x0000000000BB0000-0x0000000000BF7000-memory.dmp

Filesize
284KB

Download
memory/1004-55-0x0000000000BB0000-0x0000000000BF7000-memory.dmp

Filesize
284KB

Download
memory/1004-57-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/1256-58-0x00000000750B0000-0x00000000750F7000-memory.dmp

Filesize
284KB

Download
memory/1256-59-0x00000000750B0000-0x00000000750F7000-memory.dmp

Filesize
284KB

Download