8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb

Analysis

max time kernel
151s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe
Size

391KB
MD5

51635818139494af4749a84d3d7d0ffa
SHA1

8438d2c4debbab53c98521b0fe6e5cde21286d36
SHA256

8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb
SHA512

23504894f73b850814d9fe66dbaec32d6f5e05089be278a3f9473b55a1e62cda1a042c076da83f10df15272569f9eff590054af4d40f7d7045b82b7810678790
SSDEEP

6144:vq1bG2FzEzXz2+USL+Wyv5mwEZj0M1dEfLZjWORPXAvrCzWsl+HDSD+HzbPTcF:SrFonLyLv5xEd0MbETZjXVWZ2D+HzTT

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\PIS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe /cs:1 "	8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\PIS = "\"C:\\ProgramData\\b68651\\PIb68_195.exe\" /s"	8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\	8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
1016	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1016	2020	8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe	26
PID 2020 wrote to memory of 1016	2020	8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe	26
PID 2020 wrote to memory of 1016	2020	8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe	26
PID 2020 wrote to memory of 1016	2020	8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe	26

C:\Users\Admin\AppData\Local\Temp\8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe
"C:\Users\Admin\AppData\Local\Temp\8fdabbede32ed24eb4a28255ff3758f7ed371688bdd32bcf5e1b8b8d6ece56bb.exe"
1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /F /IM MSASCui* /IM avg* /IM ash* /IM McSA* /IM msse*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-56-0x0000000000000000-mapping.dmp

Download
memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2020-57-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download