c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65

Analysis

max time kernel
250s
max time network
357s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe
Size

183KB
MD5

f142f5a3d6d146a173f090114a13e519
SHA1

8f684eb49771209c947796c728dfd469db9aa359
SHA256

c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65
SHA512

cb4395bbe9adf77f3a3de0072310146354eb470f4173e911ebe0832567504d98b04cdf53370a6d117887fe1bf9acea0ac6e8124fe842f1d0f1981cb9aec3cb4a
SSDEEP

3072:YzNWMKKRZYchObK91C8sV6Xmoo4LEpY/U7G5m9Y9YpQjN42XDFaMcLG:YZuuObR8sVImcyY/U7I39IQ62zFJcLG

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1880	svchort.exe

Loads dropped DLL 2 IoCs

pid	Process
1044	c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe
1044	c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchoct = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\svchort.exe"	svchort.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1880	svchort.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1880	1044	c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe	28
PID 1044 wrote to memory of 1880	1044	c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe	28
PID 1044 wrote to memory of 1880	1044	c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe	28
PID 1044 wrote to memory of 1880	1044	c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe	28

C:\Users\Admin\AppData\Local\Temp\c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe
"C:\Users\Admin\AppData\Local\Temp\c449b89e4cb2e255b6791532c5aaf2e49900d8b5f0adaee9272fd22e1fc27f65.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchort.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchort.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchort.exe

Filesize
356KB

MD5
d05c43e6ddaaac6c09ad49b4638fd2e4

SHA1
0ea1c8df96d9bf8f4447d9f1b49406d75e3a42e5

SHA256
07d18d34530ccc238707c3f426f4a40922e750eb52384c7f07e795a24f608c69

SHA512
e2443a8223990fc32bb7ca4a15253cc45f93b4847f0f0a431f78b60091c664502520c1bc931313a23e55fc5b5f648382af83035c66cce4683c97bf85366333de

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\svchort.exe

Filesize
356KB

MD5
d05c43e6ddaaac6c09ad49b4638fd2e4

SHA1
0ea1c8df96d9bf8f4447d9f1b49406d75e3a42e5

SHA256
07d18d34530ccc238707c3f426f4a40922e750eb52384c7f07e795a24f608c69

SHA512
e2443a8223990fc32bb7ca4a15253cc45f93b4847f0f0a431f78b60091c664502520c1bc931313a23e55fc5b5f648382af83035c66cce4683c97bf85366333de

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\svchort.exe

Filesize
356KB

MD5
d05c43e6ddaaac6c09ad49b4638fd2e4

SHA1
0ea1c8df96d9bf8f4447d9f1b49406d75e3a42e5

SHA256
07d18d34530ccc238707c3f426f4a40922e750eb52384c7f07e795a24f608c69

SHA512
e2443a8223990fc32bb7ca4a15253cc45f93b4847f0f0a431f78b60091c664502520c1bc931313a23e55fc5b5f648382af83035c66cce4683c97bf85366333de

Download Submit
memory/1044-54-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download
memory/1880-57-0x0000000000000000-mapping.dmp

Download