e774b64170ea54274f9193e871da0412fa53835451f2f26277d9a474ff1ae7d5

Analysis

max time kernel
151s
max time network
102s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.4MB
Sample221202-vj6easff99
SHA256 e774b64170ea54274f9193e871da0412fa53835451f2f26277d9a474ff1ae7d5
MD5 05c5dc2cf2e45d2209a1f583a256c792
SHA1 d549e0a7561335ac03aca3d63d35061737e2b5e6
SHA512 ccf76efb0ad9c1abc1b364ab171bb79aee5120a322d6596eacae4e5f8d7aa8b7dd6a4a6b0c7276b23a5ff3bcfa471c11a0e38fb3ed688eb7baf618ade0c7143a
SSDEEP 24576:Dp+XtrPZzdV8uQaBRua7hrCHQYj2HsLzFXiyVrbpLMfvv8mJ3+LJjKMf:DatrRxJQq4U0pj2Hs0gLkkmB+Df
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1212	loniji_pewifi hoxim yojoya yibe.exe

Deletes itself 1 IoCs

pid	Process
792	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2028	file.exe
2028	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
636	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1516	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2028	file.exe
2028	file.exe
2028	file.exe
2028	file.exe
2028	file.exe
1212	loniji_pewifi hoxim yojoya yibe.exe
1212	loniji_pewifi hoxim yojoya yibe.exe
1212	loniji_pewifi hoxim yojoya yibe.exe
1212	loniji_pewifi hoxim yojoya yibe.exe
1212	loniji_pewifi hoxim yojoya yibe.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 636	2028	file.exe	29
PID 2028 wrote to memory of 636	2028	file.exe	29
PID 2028 wrote to memory of 636	2028	file.exe	29
PID 2028 wrote to memory of 636	2028	file.exe	29
PID 2028 wrote to memory of 1212	2028	file.exe	31
PID 2028 wrote to memory of 1212	2028	file.exe	31
PID 2028 wrote to memory of 1212	2028	file.exe	31
PID 2028 wrote to memory of 1212	2028	file.exe	31
PID 2028 wrote to memory of 792	2028	file.exe	32
PID 2028 wrote to memory of 792	2028	file.exe	32
PID 2028 wrote to memory of 792	2028	file.exe	32
PID 2028 wrote to memory of 792	2028	file.exe	32
PID 792 wrote to memory of 1400	792	cmd.exe	34
PID 792 wrote to memory of 1400	792	cmd.exe	34
PID 792 wrote to memory of 1400	792	cmd.exe	34
PID 792 wrote to memory of 1400	792	cmd.exe	34
PID 792 wrote to memory of 1516	792	cmd.exe	35
PID 792 wrote to memory of 1516	792	cmd.exe	35
PID 792 wrote to memory of 1516	792	cmd.exe	35
PID 792 wrote to memory of 1516	792	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Quo caque dimi carewi beki quitoy voxaja vogaded vob girev\loniji_pewifi hoxim yojoya yibe.exe"
  2⤵
  - Creates scheduled task(s)
  PID:636
- C:\Users\Admin\Quo caque dimi carewi beki quitoy voxaja vogaded vob girev\loniji_pewifi hoxim yojoya yibe.exe
  "C:\Users\Admin\Quo caque dimi carewi beki quitoy voxaja vogaded vob girev\loniji_pewifi hoxim yojoya yibe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loniji_pewifi hoxim yojoya yibe.exe

Path C:\Users\Admin\Quo caque dimi carewi beki quitoy voxaja vogaded vob girev\loniji_pewifi hoxim yojoya yibe.exe
Size 182.2MB
SHA256 a9248b90ffe9e7495a89abce9508b01fbf4053b6bd677dec1091f90c25fca06e
MD5 c85f2f620651825a1fb7b334a13ed83a
SHA1 5d6fff52440bb44af12a9755f98c7607f1f0846d
SHA512 fe06080e77a44c09df3231f8e147f9fb19daa7376ab26a2f24cd80ade82b51609f8e10759882ae37de5aea9a369ba69d36c0ea6538661a9cffc758ca42ae9ab0
SSDEEP 24576:Dp+XtrPZzdV8uQaBRua7hrCHQYj2HsLzFXiyVrbpLMfvv8mJ3+LJjKM:DatrRxJQq4U0pj2Hs0gLkkmB+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

loniji_pewifi hoxim yojoya yibe.exe

Path \Users\Admin\Quo caque dimi carewi beki quitoy voxaja vogaded vob girev\loniji_pewifi hoxim yojoya yibe.exe
Size 182.4MB
SHA256 1302d0eb07c1b48f3f472878eb4baa6bbb77fbcbdd1c9901885638f4fa4084fd
MD5 4bcc46165814eb8f0980193aeb524c53
SHA1 fc8ab47afd4e62e96bdd5f277f7b0fe824f10996
SHA512 1a80a13864da9f65e211e915efcf582535600708bb29e9352e2f1dea608a9999127a884d6f81a00abfe21b481c072ba9c42faa45d5966c1987509b710cbe5903
SSDEEP 24576:Dp+XtrPZzdV8uQaBRua7hrCHQYj2HsLzFXiyVrbpLMfvv8mJ3+LJjKM:DatrRxJQq4U0pj2Hs0gLkkmB+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

loniji_pewifi hoxim yojoya yibe.exe

Path \Users\Admin\Quo caque dimi carewi beki quitoy voxaja vogaded vob girev\loniji_pewifi hoxim yojoya yibe.exe
Size 189.9MB
SHA256 2c7dcb36a8fc7a2e097ca56bcc8387a549ad1984fe9f9af05898b46a75a721f7
MD5 3761944f05f717f687ca07a87c18c615
SHA1 b761da6353da59bce32c080663873955de6e7cae
SHA512 b45fc90321c7a24e0e2a7397a9ea31debffa2116cacd0160b2e69ecd426a7a044faafdd20d83fcc97c79cb80465ab1df62a89bd970fbb90de22c5ef5a269dc69
SSDEEP 24576:Dp+XtrPZzdV8uQaBRua7hrCHQYj2HsLzFXiyVrbpLMfvv8mJ3+LJjKM:DatrRxJQq4U0pj2Hs0gLkkmB+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1212-67-0x0000000006240000-0x000000000633A000-memory.dmp

Download

memory/1212-68-0x0000000006240000-0x000000000633A000-memory.dmp

Download

memory/1212-69-0x0000000011080000-0x00000000110E2000-memory.dmp

Download

memory/1212-70-0x0000000011080000-0x00000000110E2000-memory.dmp

Download

memory/1212-71-0x0000000006240000-0x000000000633A000-memory.dmp

Download

memory/2028-56-0x0000000000C20000-0x0000000000D1A000-memory.dmp

Download

memory/2028-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Download

memory/2028-54-0x0000000000C20000-0x0000000000D1A000-memory.dmp

Download

memory/2028-63-0x0000000000C20000-0x0000000000D1A000-memory.dmp

Download