Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 03:12
Static task
static1
Behavioral task
behavioral1
Sample
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe
Resource
win10v2004-20220901-en
General
-
Target
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe
-
Size
116KB
-
MD5
4ee3012b6de81e70ea3aeb1c8b63bde1
-
SHA1
11adf906465c1f81d157d068632c8a88acd676b2
-
SHA256
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b
-
SHA512
0d618c0b8920eb684e09a9edacbbf680e6cc5b21a17f1a37c3ade0e0822b1421aa289c500a4db5c4ed4164f0844a91b76fe3ffc705379657ba97b074f73c3b27
-
SSDEEP
1536:7Jcg21s3VMp5fjgQpnFGQGbDjNQo066KE8oLEFTEcK3b:qgIpWQVFobvNTh6soHcKr
Malware Config
Extracted
tofsee
103.9.150.244
188.190.120.102
121.127.250.203
188.165.132.183
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
pqiggasf.exepqiggasf.exepid process 1236 pqiggasf.exe 1572 pqiggasf.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 556 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exepid process 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\pqiggasf.exe\"" f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exepqiggasf.exepqiggasf.exedescription pid process target process PID 1768 set thread context of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1236 set thread context of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1572 set thread context of 520 1572 pqiggasf.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exepqiggasf.exepid process 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe 1236 pqiggasf.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exef0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exepqiggasf.exepqiggasf.exedescription pid process target process PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1768 wrote to memory of 1332 1768 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1332 wrote to memory of 1236 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe pqiggasf.exe PID 1332 wrote to memory of 1236 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe pqiggasf.exe PID 1332 wrote to memory of 1236 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe pqiggasf.exe PID 1332 wrote to memory of 1236 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe pqiggasf.exe PID 1332 wrote to memory of 556 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe cmd.exe PID 1332 wrote to memory of 556 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe cmd.exe PID 1332 wrote to memory of 556 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe cmd.exe PID 1332 wrote to memory of 556 1332 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe cmd.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1236 wrote to memory of 1572 1236 pqiggasf.exe pqiggasf.exe PID 1572 wrote to memory of 520 1572 pqiggasf.exe svchost.exe PID 1572 wrote to memory of 520 1572 pqiggasf.exe svchost.exe PID 1572 wrote to memory of 520 1572 pqiggasf.exe svchost.exe PID 1572 wrote to memory of 520 1572 pqiggasf.exe svchost.exe PID 1572 wrote to memory of 520 1572 pqiggasf.exe svchost.exe PID 1572 wrote to memory of 520 1572 pqiggasf.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe"C:\Users\Admin\AppData\Local\Temp\f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe"C:\Users\Admin\AppData\Local\Temp\f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\pqiggasf.exe"C:\Users\Admin\pqiggasf.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\pqiggasf.exe"C:\Users\Admin\pqiggasf.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1158.bat" "3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1158.batFilesize
302B
MD541394150cc0df28b0cbe851a6daa6671
SHA1d05463e2aef296ee59324505ed4ed8a0aaa729f8
SHA256850ace68451b04e3c3abdc2b900b7e9cb0b452290bfe519cf6ad209d11f5e76a
SHA5121ef1d5759678bf9318f69cc3773f2e0df695b76238134acddf1f70361544ed2c5195acdae18c5f602b1e60a239a6fe0820e2bcabfc2257ad3e6d05708bf8ce48
-
C:\Users\Admin\pqiggasf.exeFilesize
48.3MB
MD5769add73a50a3f5d119b3d4c3d8307b5
SHA1ba4693b5127cbb2c5a78d59f75acc3236fbb112a
SHA25627d69f6139d4e07f59b6ae6e6fd0765a7d991404f428b5af9ef17e56f32865d1
SHA512931942905ee83bac5a3e7b2c6f2bf016778ec8b8a1a4eaf264741cc23f42e2abe46707a3ad5bfffb3421afb64b2a8aab7cea992a104ba385f47bac8168a218c4
-
C:\Users\Admin\pqiggasf.exeFilesize
48.3MB
MD5769add73a50a3f5d119b3d4c3d8307b5
SHA1ba4693b5127cbb2c5a78d59f75acc3236fbb112a
SHA25627d69f6139d4e07f59b6ae6e6fd0765a7d991404f428b5af9ef17e56f32865d1
SHA512931942905ee83bac5a3e7b2c6f2bf016778ec8b8a1a4eaf264741cc23f42e2abe46707a3ad5bfffb3421afb64b2a8aab7cea992a104ba385f47bac8168a218c4
-
C:\Users\Admin\pqiggasf.exeFilesize
48.3MB
MD5769add73a50a3f5d119b3d4c3d8307b5
SHA1ba4693b5127cbb2c5a78d59f75acc3236fbb112a
SHA25627d69f6139d4e07f59b6ae6e6fd0765a7d991404f428b5af9ef17e56f32865d1
SHA512931942905ee83bac5a3e7b2c6f2bf016778ec8b8a1a4eaf264741cc23f42e2abe46707a3ad5bfffb3421afb64b2a8aab7cea992a104ba385f47bac8168a218c4
-
\Users\Admin\pqiggasf.exeFilesize
48.3MB
MD5769add73a50a3f5d119b3d4c3d8307b5
SHA1ba4693b5127cbb2c5a78d59f75acc3236fbb112a
SHA25627d69f6139d4e07f59b6ae6e6fd0765a7d991404f428b5af9ef17e56f32865d1
SHA512931942905ee83bac5a3e7b2c6f2bf016778ec8b8a1a4eaf264741cc23f42e2abe46707a3ad5bfffb3421afb64b2a8aab7cea992a104ba385f47bac8168a218c4
-
\Users\Admin\pqiggasf.exeFilesize
48.3MB
MD5769add73a50a3f5d119b3d4c3d8307b5
SHA1ba4693b5127cbb2c5a78d59f75acc3236fbb112a
SHA25627d69f6139d4e07f59b6ae6e6fd0765a7d991404f428b5af9ef17e56f32865d1
SHA512931942905ee83bac5a3e7b2c6f2bf016778ec8b8a1a4eaf264741cc23f42e2abe46707a3ad5bfffb3421afb64b2a8aab7cea992a104ba385f47bac8168a218c4
-
memory/520-101-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/520-100-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/520-94-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/520-95-0x000000000008785F-mapping.dmp
-
memory/556-75-0x0000000000000000-mapping.dmp
-
memory/1236-71-0x0000000000000000-mapping.dmp
-
memory/1332-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-66-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1332-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-64-0x000000000040785F-mapping.dmp
-
memory/1332-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1572-97-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1572-91-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1572-87-0x000000000040785F-mapping.dmp