Analysis

  • max time kernel
    167s
  • max time network
    227s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 07:10

General

  • Target

    bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8.exe

  • Size

    381KB

  • MD5

    5e536be0b235d4857d45b2924dc51a25

  • SHA1

    6370d9c049c457baa9614744d5cd1d713d7a5ae4

  • SHA256

    bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8

  • SHA512

    0026cbd10f803b1dd1c56087c9ea7824774a9254a1f94f0075dab6b265fde657c1b9c2c7587a9121f99b2c81973f6455e0eb59d6dcf62b6aacf9108966841fae

  • SSDEEP

    6144:v3KwV9fguO+AHqTy34CL7eaiXSQ58x6wdPZE9pR3mOyUXybjvkc1BAiL0zuvY:H/OPqTy34CtiXSQahPWPR3mDJf11BA0D

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8.exe
    "C:\Users\Admin\AppData\Local\Temp\bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1372 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8.exe" & start C:\Users\Admin\AppData\Local\634735.exe -f
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /pid 1372
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:884
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 3 127.1
        3⤵
        • Runs ping.exe
        PID:1464
      • C:\Users\Admin\AppData\Local\634735.exe
        C:\Users\Admin\AppData\Local\634735.exe -f
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1512

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\634735.exe

          Filesize

          381KB

          MD5

          5e536be0b235d4857d45b2924dc51a25

          SHA1

          6370d9c049c457baa9614744d5cd1d713d7a5ae4

          SHA256

          bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8

          SHA512

          0026cbd10f803b1dd1c56087c9ea7824774a9254a1f94f0075dab6b265fde657c1b9c2c7587a9121f99b2c81973f6455e0eb59d6dcf62b6aacf9108966841fae

        • C:\Users\Admin\AppData\Local\634735.exe

          Filesize

          381KB

          MD5

          5e536be0b235d4857d45b2924dc51a25

          SHA1

          6370d9c049c457baa9614744d5cd1d713d7a5ae4

          SHA256

          bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8

          SHA512

          0026cbd10f803b1dd1c56087c9ea7824774a9254a1f94f0075dab6b265fde657c1b9c2c7587a9121f99b2c81973f6455e0eb59d6dcf62b6aacf9108966841fae

        • \Users\Admin\AppData\Local\634735.exe

          Filesize

          381KB

          MD5

          5e536be0b235d4857d45b2924dc51a25

          SHA1

          6370d9c049c457baa9614744d5cd1d713d7a5ae4

          SHA256

          bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8

          SHA512

          0026cbd10f803b1dd1c56087c9ea7824774a9254a1f94f0075dab6b265fde657c1b9c2c7587a9121f99b2c81973f6455e0eb59d6dcf62b6aacf9108966841fae

        • \Users\Admin\AppData\Local\634735.exe

          Filesize

          381KB

          MD5

          5e536be0b235d4857d45b2924dc51a25

          SHA1

          6370d9c049c457baa9614744d5cd1d713d7a5ae4

          SHA256

          bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8

          SHA512

          0026cbd10f803b1dd1c56087c9ea7824774a9254a1f94f0075dab6b265fde657c1b9c2c7587a9121f99b2c81973f6455e0eb59d6dcf62b6aacf9108966841fae

        • \Users\Admin\AppData\Local\634735.exe

          Filesize

          381KB

          MD5

          5e536be0b235d4857d45b2924dc51a25

          SHA1

          6370d9c049c457baa9614744d5cd1d713d7a5ae4

          SHA256

          bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8

          SHA512

          0026cbd10f803b1dd1c56087c9ea7824774a9254a1f94f0075dab6b265fde657c1b9c2c7587a9121f99b2c81973f6455e0eb59d6dcf62b6aacf9108966841fae

        • \Users\Admin\AppData\Local\634735.exe

          Filesize

          381KB

          MD5

          5e536be0b235d4857d45b2924dc51a25

          SHA1

          6370d9c049c457baa9614744d5cd1d713d7a5ae4

          SHA256

          bbdde3d39a4ab94795578be54e1e499fa50777ef6ef41831494ffab26a331ab8

          SHA512

          0026cbd10f803b1dd1c56087c9ea7824774a9254a1f94f0075dab6b265fde657c1b9c2c7587a9121f99b2c81973f6455e0eb59d6dcf62b6aacf9108966841fae

        • memory/1372-58-0x0000000001000000-0x00000000010FF000-memory.dmp

          Filesize

          1020KB

        • memory/1372-54-0x0000000076041000-0x0000000076043000-memory.dmp

          Filesize

          8KB

        • memory/1372-56-0x0000000001000000-0x00000000010FF000-memory.dmp

          Filesize

          1020KB

        • memory/1372-55-0x0000000001000000-0x00000000010FF000-memory.dmp

          Filesize

          1020KB

        • memory/1512-67-0x0000000001000000-0x00000000010FF000-memory.dmp

          Filesize

          1020KB

        • memory/1512-69-0x0000000001000000-0x00000000010FF000-memory.dmp

          Filesize

          1020KB

        • memory/1512-71-0x0000000001000000-0x00000000010FF000-memory.dmp

          Filesize

          1020KB