c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Size

88KB
MD5

440e9b7f5ba2fc16a0c0b368abd74130
SHA1

370f814cf9e73d4396ab089b95e5135669482af1
SHA256

c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407
SHA512

63c599119c30fec5ad843faf9f71dad8be46623f851cfaac92b182e88a73a9c089ab2678b431323c5640f568816f69bc1283eae3fbdbd48f405320d5db8335b5
SSDEEP

1536:jMQKzwcnBIK+k7u7rSWiktMUtrHqSKzA+CNzGcCNs:IDzwcnj7u7rSWikKUtzq1QhGcC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 368	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	4
PID 1372 wrote to memory of 368	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	4
PID 1372 wrote to memory of 368	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	4
PID 1372 wrote to memory of 368	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	4
PID 1372 wrote to memory of 368	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	4
PID 1372 wrote to memory of 376	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	3
PID 1372 wrote to memory of 376	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	3
PID 1372 wrote to memory of 376	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	3
PID 1372 wrote to memory of 376	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	3
PID 1372 wrote to memory of 376	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	3
PID 1372 wrote to memory of 408	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	2
PID 1372 wrote to memory of 408	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	2
PID 1372 wrote to memory of 408	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	2
PID 1372 wrote to memory of 408	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	2
PID 1372 wrote to memory of 408	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	2
PID 1372 wrote to memory of 464	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	1
PID 1372 wrote to memory of 464	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	1
PID 1372 wrote to memory of 464	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	1
PID 1372 wrote to memory of 464	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	1
PID 1372 wrote to memory of 464	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	1
PID 1372 wrote to memory of 472	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	7
PID 1372 wrote to memory of 472	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	7
PID 1372 wrote to memory of 472	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	7
PID 1372 wrote to memory of 472	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	7
PID 1372 wrote to memory of 472	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	7
PID 1372 wrote to memory of 480	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	8
PID 1372 wrote to memory of 480	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	8
PID 1372 wrote to memory of 480	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	8
PID 1372 wrote to memory of 480	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	8
PID 1372 wrote to memory of 480	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	8
PID 1372 wrote to memory of 588	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	26
PID 1372 wrote to memory of 588	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	26
PID 1372 wrote to memory of 588	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	26
PID 1372 wrote to memory of 588	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	26
PID 1372 wrote to memory of 588	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	26
PID 1372 wrote to memory of 668	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	25
PID 1372 wrote to memory of 668	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	25
PID 1372 wrote to memory of 668	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	25
PID 1372 wrote to memory of 668	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	25
PID 1372 wrote to memory of 668	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	25
PID 1372 wrote to memory of 744	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	24
PID 1372 wrote to memory of 744	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	24
PID 1372 wrote to memory of 744	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	24
PID 1372 wrote to memory of 744	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	24
PID 1372 wrote to memory of 744	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	24
PID 1372 wrote to memory of 808	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	23
PID 1372 wrote to memory of 808	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	23
PID 1372 wrote to memory of 808	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	23
PID 1372 wrote to memory of 808	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	23
PID 1372 wrote to memory of 808	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	23
PID 1372 wrote to memory of 844	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	22
PID 1372 wrote to memory of 844	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	22
PID 1372 wrote to memory of 844	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	22
PID 1372 wrote to memory of 844	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	22
PID 1372 wrote to memory of 844	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	22
PID 1372 wrote to memory of 872	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	21
PID 1372 wrote to memory of 872	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	21
PID 1372 wrote to memory of 872	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	21
PID 1372 wrote to memory of 872	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	21
PID 1372 wrote to memory of 872	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	21
PID 1372 wrote to memory of 300	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	20
PID 1372 wrote to memory of 300	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	20
PID 1372 wrote to memory of 300	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	20
PID 1372 wrote to memory of 300	1372	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	20

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1656
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1552
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1232
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1044
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:300
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:408

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:472
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:480

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:368

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1384
- C:\Users\Admin\AppData\Local\Temp\c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
  "C:\Users\Admin\AppData\Local\Temp\c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1372

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1636

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1412

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1372-55-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download
memory/1372-56-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1372-57-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download