Analysis
-
max time kernel
163s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 17:52
Static task
static1
Behavioral task
behavioral1
Sample
ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe
Resource
win10v2004-20221111-en
General
-
Target
ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe
-
Size
367KB
-
MD5
bbf0bfc80cf742e1f19e7e053e78b2fb
-
SHA1
9010f6087f50555b16219a40a03943bca3002970
-
SHA256
ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278
-
SHA512
2f2f7dde23733066c8e0050902f1eb544d47ddbac6dc033339ad37e7f0cd80d13d68df7a47e68746d24168905de8715a224a7db5438658eaa1d0ac27283f180c
-
SSDEEP
6144:JKVtzpAShNxvAg/j4oEDjmTyZC6dIffK6uINK6Fwgd8yf9C:JKVtp7vXj4oE2uZC6d6fKuAOxh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
vwvkdthwzz.exepid process 1720 vwvkdthwzz.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1952 cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exevwvkdthwzz.exepid process 1952 cmd.exe 1952 cmd.exe 1720 vwvkdthwzz.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1928 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
vwvkdthwzz.exepid process 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1928 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
vwvkdthwzz.exepid process 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
vwvkdthwzz.exepid process 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe 1720 vwvkdthwzz.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.execmd.exedescription pid process target process PID 284 wrote to memory of 1952 284 ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe cmd.exe PID 284 wrote to memory of 1952 284 ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe cmd.exe PID 284 wrote to memory of 1952 284 ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe cmd.exe PID 284 wrote to memory of 1952 284 ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe cmd.exe PID 1952 wrote to memory of 1928 1952 cmd.exe taskkill.exe PID 1952 wrote to memory of 1928 1952 cmd.exe taskkill.exe PID 1952 wrote to memory of 1928 1952 cmd.exe taskkill.exe PID 1952 wrote to memory of 1928 1952 cmd.exe taskkill.exe PID 1952 wrote to memory of 1972 1952 cmd.exe PING.EXE PID 1952 wrote to memory of 1972 1952 cmd.exe PING.EXE PID 1952 wrote to memory of 1972 1952 cmd.exe PING.EXE PID 1952 wrote to memory of 1972 1952 cmd.exe PING.EXE PID 1952 wrote to memory of 1720 1952 cmd.exe vwvkdthwzz.exe PID 1952 wrote to memory of 1720 1952 cmd.exe vwvkdthwzz.exe PID 1952 wrote to memory of 1720 1952 cmd.exe vwvkdthwzz.exe PID 1952 wrote to memory of 1720 1952 cmd.exe vwvkdthwzz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe"C:\Users\Admin\AppData\Local\Temp\ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 284 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278.exe" & start C:\Users\Admin\AppData\Local\VWVKDT~1.EXE -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 2843⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\vwvkdthwzz.exeC:\Users\Admin\AppData\Local\VWVKDT~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\vwvkdthwzz.exeFilesize
367KB
MD5bbf0bfc80cf742e1f19e7e053e78b2fb
SHA19010f6087f50555b16219a40a03943bca3002970
SHA256ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278
SHA5122f2f7dde23733066c8e0050902f1eb544d47ddbac6dc033339ad37e7f0cd80d13d68df7a47e68746d24168905de8715a224a7db5438658eaa1d0ac27283f180c
-
C:\Users\Admin\AppData\Local\vwvkdthwzz.exeFilesize
367KB
MD5bbf0bfc80cf742e1f19e7e053e78b2fb
SHA19010f6087f50555b16219a40a03943bca3002970
SHA256ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278
SHA5122f2f7dde23733066c8e0050902f1eb544d47ddbac6dc033339ad37e7f0cd80d13d68df7a47e68746d24168905de8715a224a7db5438658eaa1d0ac27283f180c
-
\Users\Admin\AppData\Local\vwvkdthwzz.exeFilesize
367KB
MD5bbf0bfc80cf742e1f19e7e053e78b2fb
SHA19010f6087f50555b16219a40a03943bca3002970
SHA256ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278
SHA5122f2f7dde23733066c8e0050902f1eb544d47ddbac6dc033339ad37e7f0cd80d13d68df7a47e68746d24168905de8715a224a7db5438658eaa1d0ac27283f180c
-
\Users\Admin\AppData\Local\vwvkdthwzz.exeFilesize
367KB
MD5bbf0bfc80cf742e1f19e7e053e78b2fb
SHA19010f6087f50555b16219a40a03943bca3002970
SHA256ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278
SHA5122f2f7dde23733066c8e0050902f1eb544d47ddbac6dc033339ad37e7f0cd80d13d68df7a47e68746d24168905de8715a224a7db5438658eaa1d0ac27283f180c
-
\Users\Admin\AppData\Local\vwvkdthwzz.exeFilesize
367KB
MD5bbf0bfc80cf742e1f19e7e053e78b2fb
SHA19010f6087f50555b16219a40a03943bca3002970
SHA256ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278
SHA5122f2f7dde23733066c8e0050902f1eb544d47ddbac6dc033339ad37e7f0cd80d13d68df7a47e68746d24168905de8715a224a7db5438658eaa1d0ac27283f180c
-
memory/284-57-0x0000000001000000-0x00000000010A6000-memory.dmpFilesize
664KB
-
memory/284-54-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/284-55-0x00000000002F0000-0x00000000002F3000-memory.dmpFilesize
12KB
-
memory/1720-63-0x0000000000000000-mapping.dmp
-
memory/1720-67-0x0000000001000000-0x00000000010A6000-memory.dmpFilesize
664KB
-
memory/1720-68-0x0000000001000000-0x00000000010A6000-memory.dmpFilesize
664KB
-
memory/1928-58-0x0000000000000000-mapping.dmp
-
memory/1952-56-0x0000000000000000-mapping.dmp
-
memory/1972-59-0x0000000000000000-mapping.dmp