f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

Analysis

max time kernel
189s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe
Size

32KB
MD5

0955e6d7605a33f8ade579b346482c70
SHA1

f61ae645a5c6e2b283fd539793eb2afd90edc074
SHA256

f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d
SHA512

33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026
SSDEEP

768:2ASaMFGSLPKrZfbAW4wo6Dd3iqGXH5iJBvveB/8UNU:2AcFGSLPKrZfbARwo6R3iqGpIBeKUNU

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1776	suchost..exe
1640	svchost..exe
1948	suchost..exe
1884	svchost..exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe

Loads dropped DLL 2 IoCs

pid	Process
1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe
1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1884	svchost..exe
1640	svchost..exe
1776	suchost..exe
1640	svchost..exe
1884	svchost..exe
1948	suchost..exe
1776	suchost..exe
1640	svchost..exe
1884	svchost..exe
1776	suchost..exe
1948	suchost..exe
1948	suchost..exe
1640	svchost..exe
1884	svchost..exe
1776	suchost..exe
1884	svchost..exe
1948	suchost..exe
1776	suchost..exe
1640	svchost..exe
1884	svchost..exe
1776	suchost..exe
1640	svchost..exe
1948	suchost..exe
1640	svchost..exe
1948	suchost..exe
1776	suchost..exe
1884	svchost..exe
1640	svchost..exe
1948	suchost..exe
1884	svchost..exe
1776	suchost..exe
1640	svchost..exe
1776	suchost..exe
1884	svchost..exe
1948	suchost..exe
1884	svchost..exe
1948	suchost..exe
1640	svchost..exe
1776	suchost..exe
1640	svchost..exe
1948	suchost..exe
1776	suchost..exe
1884	svchost..exe
1640	svchost..exe
1776	suchost..exe
1948	suchost..exe
1884	svchost..exe
1884	svchost..exe
1640	svchost..exe
1776	suchost..exe
1948	suchost..exe
1640	svchost..exe
1948	suchost..exe
1776	suchost..exe
1884	svchost..exe
1884	svchost..exe
1640	svchost..exe
1776	suchost..exe
1948	suchost..exe
1640	svchost..exe
1776	suchost..exe
1884	svchost..exe
1948	suchost..exe
1640	svchost..exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	svchost..exe
Token: SeDebugPrivilege	1640	svchost..exe
Token: SeDebugPrivilege	1776	suchost..exe
Token: SeDebugPrivilege	1948	suchost..exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1776	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	28
PID 1396 wrote to memory of 1776	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	28
PID 1396 wrote to memory of 1776	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	28
PID 1396 wrote to memory of 1776	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	28
PID 1396 wrote to memory of 1640	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	29
PID 1396 wrote to memory of 1640	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	29
PID 1396 wrote to memory of 1640	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	29
PID 1396 wrote to memory of 1640	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	29
PID 1396 wrote to memory of 1948	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	30
PID 1396 wrote to memory of 1948	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	30
PID 1396 wrote to memory of 1948	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	30
PID 1396 wrote to memory of 1948	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	30
PID 1396 wrote to memory of 1884	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	31
PID 1396 wrote to memory of 1884	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	31
PID 1396 wrote to memory of 1884	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	31
PID 1396 wrote to memory of 1884	1396	f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe	31

C:\Users\Admin\AppData\Local\Temp\f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe
"C:\Users\Admin\AppData\Local\Temp\f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\Documents\suchost..exe
  "C:\Users\Admin\Documents\suchost..exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Users\Admin\Documents\suchost..exe
  "C:\Users\Admin\Documents\suchost..exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe

Filesize
32KB

MD5
0955e6d7605a33f8ade579b346482c70

SHA1
f61ae645a5c6e2b283fd539793eb2afd90edc074

SHA256
f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

SHA512
33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe

Filesize
32KB

MD5
0955e6d7605a33f8ade579b346482c70

SHA1
f61ae645a5c6e2b283fd539793eb2afd90edc074

SHA256
f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

SHA512
33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe

Filesize
32KB

MD5
0955e6d7605a33f8ade579b346482c70

SHA1
f61ae645a5c6e2b283fd539793eb2afd90edc074

SHA256
f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

SHA512
33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026

Download Submit
C:\Users\Admin\Documents\suchost..exe

Filesize
32KB

MD5
0955e6d7605a33f8ade579b346482c70

SHA1
f61ae645a5c6e2b283fd539793eb2afd90edc074

SHA256
f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

SHA512
33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026

Download Submit
C:\Users\Admin\Documents\suchost..exe

Filesize
32KB

MD5
0955e6d7605a33f8ade579b346482c70

SHA1
f61ae645a5c6e2b283fd539793eb2afd90edc074

SHA256
f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

SHA512
33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026

Download Submit
C:\Users\Admin\Documents\suchost..exe

Filesize
32KB

MD5
0955e6d7605a33f8ade579b346482c70

SHA1
f61ae645a5c6e2b283fd539793eb2afd90edc074

SHA256
f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

SHA512
33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe

Filesize
32KB

MD5
0955e6d7605a33f8ade579b346482c70

SHA1
f61ae645a5c6e2b283fd539793eb2afd90edc074

SHA256
f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

SHA512
33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026

Download Submit
\Users\Admin\Documents\suchost..exe

Filesize
32KB

MD5
0955e6d7605a33f8ade579b346482c70

SHA1
f61ae645a5c6e2b283fd539793eb2afd90edc074

SHA256
f39bad0d1a08e86970f31a9f08dd26db53394b394f0d9e30f11645ea27abd57d

SHA512
33732453d6bcf7618ce5c2f9612b93240ba29e35d97f4fb97c8f3aac88cd64f9ce7e96c7031c1c7fa493f3b02f6c73bfeb1f3ca402e6a726dc073ff7246ea026

Download Submit
memory/1396-78-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1396-62-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1396-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1396-79-0x0000000002105000-0x0000000002116000-memory.dmp

Filesize
68KB

Download
memory/1396-55-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1640-83-0x0000000000C75000-0x0000000000C86000-memory.dmp

Filesize
68KB

Download
memory/1640-90-0x0000000000C75000-0x0000000000C86000-memory.dmp

Filesize
68KB

Download
memory/1640-84-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1640-75-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1776-63-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1776-81-0x00000000005F5000-0x0000000000606000-memory.dmp

Filesize
68KB

Download
memory/1776-61-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1776-88-0x00000000005F5000-0x0000000000606000-memory.dmp

Filesize
68KB

Download
memory/1884-86-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-89-0x00000000002D5000-0x00000000002E6000-memory.dmp

Filesize
68KB

Download
memory/1884-77-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-82-0x00000000002D5000-0x00000000002E6000-memory.dmp

Filesize
68KB

Download
memory/1948-80-0x0000000000115000-0x0000000000126000-memory.dmp

Filesize
68KB

Download
memory/1948-87-0x0000000000115000-0x0000000000126000-memory.dmp

Filesize
68KB

Download
memory/1948-85-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1948-76-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download