c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe
Size

38KB
MD5

110c3a60548017eb5744b3eec070dea5
SHA1

3657ee398570aac565798ae605d8eb3aa07244b3
SHA256

c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78
SHA512

1c0eaf7e2e00393bcc9e59f72dd6190ab77bc6b9dc2ba4e7d98f7ec83927bf2df4563f76e8e9f48a4b943cf65b7bea9575423adb36b99847842b1b439493cdd8
SSDEEP

768:oMhyQa2abxKHBRZkZxXxpRoD7u21wGFo8sRvxRC8r2Gmfb6/yO:by9xKHBcXxpRo222GAPr2Gmz6yO

Score

8^/10

evasion upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
900	dev1.exe

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
2008	attrib.exe
1312	attrib.exe
652	attrib.exe
1512	attrib.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000000b2d2-58.dat	upx
behavioral1/memory/900-73-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
900	dev1.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev1.exe	c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1936	ipconfig.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1396	c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 900	1396	c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe	27
PID 1396 wrote to memory of 900	1396	c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe	27
PID 1396 wrote to memory of 900	1396	c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe	27
PID 1396 wrote to memory of 900	1396	c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe	27
PID 900 wrote to memory of 1652	900	dev1.exe	29
PID 900 wrote to memory of 1652	900	dev1.exe	29
PID 900 wrote to memory of 1652	900	dev1.exe	29
PID 900 wrote to memory of 1652	900	dev1.exe	29
PID 1652 wrote to memory of 524	1652	cmd.exe	30
PID 1652 wrote to memory of 524	1652	cmd.exe	30
PID 1652 wrote to memory of 524	1652	cmd.exe	30
PID 1652 wrote to memory of 524	1652	cmd.exe	30
PID 1652 wrote to memory of 1144	1652	cmd.exe	31
PID 1652 wrote to memory of 1144	1652	cmd.exe	31
PID 1652 wrote to memory of 1144	1652	cmd.exe	31
PID 1652 wrote to memory of 1144	1652	cmd.exe	31
PID 1652 wrote to memory of 640	1652	cmd.exe	32
PID 1652 wrote to memory of 640	1652	cmd.exe	32
PID 1652 wrote to memory of 640	1652	cmd.exe	32
PID 1652 wrote to memory of 640	1652	cmd.exe	32
PID 1652 wrote to memory of 780	1652	cmd.exe	33
PID 1652 wrote to memory of 780	1652	cmd.exe	33
PID 1652 wrote to memory of 780	1652	cmd.exe	33
PID 1652 wrote to memory of 780	1652	cmd.exe	33
PID 1652 wrote to memory of 2008	1652	cmd.exe	34
PID 1652 wrote to memory of 2008	1652	cmd.exe	34
PID 1652 wrote to memory of 2008	1652	cmd.exe	34
PID 1652 wrote to memory of 2008	1652	cmd.exe	34
PID 1652 wrote to memory of 1312	1652	cmd.exe	35
PID 1652 wrote to memory of 1312	1652	cmd.exe	35
PID 1652 wrote to memory of 1312	1652	cmd.exe	35
PID 1652 wrote to memory of 1312	1652	cmd.exe	35
PID 1652 wrote to memory of 652	1652	cmd.exe	36
PID 1652 wrote to memory of 652	1652	cmd.exe	36
PID 1652 wrote to memory of 652	1652	cmd.exe	36
PID 1652 wrote to memory of 652	1652	cmd.exe	36
PID 1652 wrote to memory of 1512	1652	cmd.exe	37
PID 1652 wrote to memory of 1512	1652	cmd.exe	37
PID 1652 wrote to memory of 1512	1652	cmd.exe	37
PID 1652 wrote to memory of 1512	1652	cmd.exe	37
PID 1652 wrote to memory of 1936	1652	cmd.exe	38
PID 1652 wrote to memory of 1936	1652	cmd.exe	38
PID 1652 wrote to memory of 1936	1652	cmd.exe	38
PID 1652 wrote to memory of 1936	1652	cmd.exe	38

Views/modifies file attributes 1 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2008	attrib.exe
1312	attrib.exe
652	attrib.exe
1512	attrib.exe
524	attrib.exe
1144	attrib.exe
640	attrib.exe
780	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe
"C:\Users\Admin\AppData\Local\Temp\c8d480401bbb1cf92a6b198c5d3dde67bd2dfe8dfe89b18bdfc9fc39e9ef1e78.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\dev1.exe
  "C:\Windows\dev1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\983.tmp\dev1.bat""
    3⤵
    - Drops file in Drivers directory
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -s -h -r C:\Windows\system32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -s -h -r C:\Windows\system32\drivers\hosts
      4⤵
      Views/modifies file attributes
      PID:1144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -s -h -r C:\Windows\system32\hosts
      4⤵
      Views/modifies file attributes
      PID:640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -s -h -r C:\Windows\hosts
      4⤵
      Views/modifies file attributes
      PID:780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r C:\Windows\system32\drivers\etc\hosts
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r C:\Windows\system32\drivers\hosts
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1312
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r C:\Windows\system32\hosts
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r C:\Windows\hosts
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1512
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\983.tmp\dev1.bat

Filesize
5KB

MD5
02fbf8b34cc6ae565091601461ba872b

SHA1
9916400e25942bdff68bd6f0b8cd660bae6d9523

SHA256
8324b41e843886c04d09cb599e18bbd9324f5bd959bc7ea7801189de4864d176

SHA512
e1727bf9f536b9042aaf74a9bca4853749182486c40026d8e2f568e8d7570ebe96b5b14134f75eb592734a1d088434ed853500b44459a3308f85794974685bbd

Download Submit
C:\Windows\dev1.exe

Filesize
17KB

MD5
f4ea80c46285d3c3e4dcd107c89b333a

SHA1
e39a55ee41952a213faff76ef04034f35dcfd2de

SHA256
cbee57672949f317bdff237e9cf4f8468fb0f3d3d656fc35e23e8d2969b95da6

SHA512
2bf9ad2bddedc3a9c2f3cd832402218b346664ce8909263aa06249d9e65eea6cf81a2186535adb80c7794e855783f145f0ecdabeab875fdf03f78e119a64f199

Download Submit
\Users\Admin\AppData\Local\Temp\983.tmp\b2e.dll

Filesize
31KB

MD5
7b860f28be19d4aef761fb991134a556

SHA1
0658a7456d0234dcca598b6ee599fe134d0ecd61

SHA256
57a2586d73188a694944c7da60c78380f82fac46452ed1a31c818ceb93e660bc

SHA512
a0685a25cbc3fff74aa4ad538ade5282242980f07fe1171e01644e0fa98e1ec6adc87b943290983f6fb5070d26fc15d697ae31a1f570e83e504ae1e4508aefa5

Download Submit
memory/900-73-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1396-56-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads