99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b

Analysis

max time kernel
246s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Size

283KB
MD5

53dc0ea8e7900547142e4e6d1b7f8bae
SHA1

0398ed2e4dab903afe34e5c01fd7b59152973898
SHA256

99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b
SHA512

4fdefd45423a71025aae92340e0a38fe666425e30dc032823e731d82269a9659bc5601ced13114b809a496785b77385f11404fdea957d7ffdf6ed0ccac516059
SSDEEP

6144:8/673sqnWS7AvyD+oThinaZh9nIJNHg+f2XOoT2jc6oSI:v3sq37Avg+BaD4h2XOox6oSI

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/288-55-0x0000000000400000-0x00000000004D8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kernel32 = "C:\\Windows\\kernel32.dlI"	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\kernel32.dlI	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
File opened for modification	C:\Windows\kernel32.dlI	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WD\kernel32.dlIfile\shell\open\command\ = "%1"	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\%WD\kernel32.dlI	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\%WD	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WD	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WD\kernel32.dlIfile	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WD\kernel32.dlIfile\shell\open	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\%WD\kernel32.dlI\ = "WD\\kernel32.dlIfile"	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WD\kernel32.dlIfile\shell\open\command	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WD\kernel32.dlIfile\shell	99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe

C:\Users\Admin\AppData\Local\Temp\99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe
"C:\Users\Admin\AppData\Local\Temp\99efaa2960d543cc6fa2e7d07fd2fde0c9c3e7ced64ba297f85aaa23fbfacc9b.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/288-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download