c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025

Analysis

max time kernel
136s
max time network
118s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe
Size

368KB
MD5

8fb002e3c25dfc6cd2759b752892d648
SHA1

63fd3ac8fa1de012933f84017be8f8b9424ffdd5
SHA256

c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025
SHA512

2e2cba3507a32eb01909ab69799b3ade2582e5e4c15062948dc2852f5245f660c60f9717f240269be66056194b1612e21aaf87be6ea3cfee25f6a5b6a2379826
SSDEEP

6144:XC8J+0uCDXtFyGuF5B1E2FyhvS+uS3Uw2zbHBNIGRbJKWuovyDM//aLwhDOXOvBE:XCJudXsB1EgyhK+FUfbwGOovC6aLOyCy

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gjkBuTTBqgDZ = "C:\\PROGRA~3\\gjkBuTTBqgDZ.exe"	gjkBuTTBqgDZ.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	gjkBuTTBqgDZ.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\gjkBuTTBqgDZ	gjkBuTTBqgDZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	gjkBuTTBqgDZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	gjkBuTTBqgDZ.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1788	c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe
1788	c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe
1600	gjkBuTTBqgDZ.exe
1600	gjkBuTTBqgDZ.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1788	c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1600	gjkBuTTBqgDZ.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1600	gjkBuTTBqgDZ.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1788	c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe
1600	gjkBuTTBqgDZ.exe
1600	gjkBuTTBqgDZ.exe
1600	gjkBuTTBqgDZ.exe
1600	gjkBuTTBqgDZ.exe
1600	gjkBuTTBqgDZ.exe
1600	gjkBuTTBqgDZ.exe
1600	gjkBuTTBqgDZ.exe
1600	gjkBuTTBqgDZ.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1600	1788	c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe	27
PID 1788 wrote to memory of 1600	1788	c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe	27
PID 1788 wrote to memory of 1600	1788	c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe	27
PID 1788 wrote to memory of 1600	1788	c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe	27

C:\Users\Admin\AppData\Local\Temp\c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe
"C:\Users\Admin\AppData\Local\Temp\c7700e222c469ad762d34e79a3da0d10642c2b1ea2084110f26f54f15d231025.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788
- C:\PROGRA~3\gjkBuTTBqgDZ.exe
  C:\PROGRA~3\gjkBuTTBqgDZ.exe
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-60-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/1600-61-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/1788-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1788-55-0x0000000000320000-0x0000000000378000-memory.dmp

Filesize
352KB

Download
memory/1788-56-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/1788-58-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download