cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
Size

154KB
MD5

0d59b0751893881198ff41def10ab090
SHA1

e8ed8492fdc890b136a7044e6c1b0628736fbb50
SHA256

cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1
SHA512

1b57b3b942777cc1b78c21d09d142c4ac7c4e0a43fb8b17cb8a4445abf6048aff9b71cf54413ccc814d7f1c99e6444675151ea83883d607d2f0f808167a04553
SSDEEP

3072:pz7gJv8sqT6MM6MMMMMMMMM2kD+ipe9yB8vbk9T7QM65aqHVHN148jd3Aa0k4Pov:pz7aYNyBYA1Y148jd3Aa1X2dc53n

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\50158 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mssdxa.scr"	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
760	~msiexec.exe
1648	~msiexec.exe

Loads dropped DLL 7 IoCs

pid	Process
1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
760	~msiexec.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	~msiexec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	~msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1132 set thread context of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 760 set thread context of 1648	760	~msiexec.exe	29

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\mssdxa.scr	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
1648	~msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1648	~msiexec.exe
1648	~msiexec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1132 wrote to memory of 1920	1132	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	27
PID 1920 wrote to memory of 760	1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	28
PID 1920 wrote to memory of 760	1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	28
PID 1920 wrote to memory of 760	1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	28
PID 1920 wrote to memory of 760	1920	cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe	28
PID 760 wrote to memory of 1648	760	~msiexec.exe	29
PID 760 wrote to memory of 1648	760	~msiexec.exe	29
PID 760 wrote to memory of 1648	760	~msiexec.exe	29
PID 760 wrote to memory of 1648	760	~msiexec.exe	29
PID 760 wrote to memory of 1648	760	~msiexec.exe	29
PID 760 wrote to memory of 1648	760	~msiexec.exe	29
PID 1648 wrote to memory of 572	1648	~msiexec.exe	30
PID 1648 wrote to memory of 572	1648	~msiexec.exe	30
PID 1648 wrote to memory of 572	1648	~msiexec.exe	30
PID 1648 wrote to memory of 572	1648	~msiexec.exe	30

C:\Users\Admin\AppData\Local\Temp\cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
"C:\Users\Admin\AppData\Local\Temp\cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe
  "C:\Users\Admin\AppData\Local\Temp\cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe
    "C:\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe
      "C:\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe"
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1648
    - - C:\Windows\syswow64\svchost.exe
        
        C:\Windows\syswow64\svchost.exe
        5⤵
        Adds policy Run key to start application
        Drops file in Program Files directory
        
        PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe

Filesize
154KB

MD5
0d59b0751893881198ff41def10ab090

SHA1
e8ed8492fdc890b136a7044e6c1b0628736fbb50

SHA256
cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1

SHA512
1b57b3b942777cc1b78c21d09d142c4ac7c4e0a43fb8b17cb8a4445abf6048aff9b71cf54413ccc814d7f1c99e6444675151ea83883d607d2f0f808167a04553

Download Submit
\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
\Users\Admin\AppData\Local\Temp\$MSI\~msiexec.exe

Filesize
38KB

MD5
d86b3d87bc92c5c41282e86d16b7e195

SHA1
0cc2c18c50bc5154957e9aeed74a8c14aa227754

SHA256
d1dfda6feab3fbae25a43ba9cf2eee3cf6f90fe4f4699c6013764977dd84804a

SHA512
3dcd2403983c71fe07b946828fc4e62b1a16ba7895643df330390231cc4206182702466b46dc5411627327b23f7e4f51b21ec56a2690e383625eb9875e5ae9fb

Download Submit
\Users\Admin\AppData\Local\Temp\cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1.exe

Filesize
154KB

MD5
0d59b0751893881198ff41def10ab090

SHA1
e8ed8492fdc890b136a7044e6c1b0628736fbb50

SHA256
cecc437b13882744cfc1a31945ee3c1875c4978357e70faae3ab943512eea1a1

SHA512
1b57b3b942777cc1b78c21d09d142c4ac7c4e0a43fb8b17cb8a4445abf6048aff9b71cf54413ccc814d7f1c99e6444675151ea83883d607d2f0f808167a04553

Download Submit
memory/572-95-0x0000000000150000-0x000000000016F000-memory.dmp

Filesize
124KB

Download
memory/572-96-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/572-92-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/572-91-0x0000000000F10000-0x0000000000F18000-memory.dmp

Filesize
32KB

Download
memory/572-93-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1132-54-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/1648-84-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1648-86-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1648-90-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1648-83-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1920-70-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-79-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-65-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-64-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-71-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-63-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-61-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-59-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1920-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download