ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e

Analysis

max time kernel
169s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
Size

22.4MB
MD5

0c0958afa2f46d9617a9fd6ab7468bb8
SHA1

0771c861a7bdc702397766e7fc7c2c0e1315bbd8
SHA256

ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e
SHA512

7540571207bda3123c01688ae1779c272638a1d3698aa4a2f1dbe0c90ef4eaf1e0d2d3178c6cd255bf6736af3840d76f8aeef3b081e1b958891a3ecd17ff6a5a
SSDEEP

49152:ZMk2fdATU8bAz6JKRR86gulWpeWmenMj0yzPaxrTCy58e6FjBL:ZMy+O6NlIeWmbj5rapCY56Fjt

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4012	vsafe_setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vsafe = "C:\\Program Files\\Muxjl\\Elfpu.exe /vsafe /{84FDCE47-03D4-49A7-B09F-1914BD167849}"	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Muxjl\hesoce\toneos.dll	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File created	C:\Program Files\Muxjl\megese.exe	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File created	C:\Program Files\Muxjl\dugese.exe	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File opened for modification	C:\Program Files\Muxjl\dugese.exe	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File opened for modification	C:\Program Files\Muxjl\hesoce\pat.xml	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File created	C:\Program Files\Common Files\System\Ole DB\MSPat.xml	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\MSPat.xml	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File created	C:\Program Files\Muxjl\hesoce\pat.xml	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File created	C:\Program Files\Muxjl\hesoce\toneos.dll	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
File opened for modification	C:\Program Files\Muxjl\megese.exe	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4012	vsafe_setup.exe
4012	vsafe_setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 4012	1264	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe	84
PID 1264 wrote to memory of 4012	1264	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe	84
PID 1264 wrote to memory of 4012	1264	ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe	84

C:\Users\Admin\AppData\Local\Temp\ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe
"C:\Users\Admin\AppData\Local\Temp\ab0701c1749a772533308206f51b7ca233bfe6231a37d9d7af779ea37a4f9e1e.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\g8635D\vsafe_setup.exe
  C:\Users\Admin\AppData\Local\Temp\g8635D\vsafe_setup.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\g8635D\vsafe_setup.exe

Filesize
500KB

MD5
80acfba01b15107fb95a61131dc8a4f2

SHA1
605caa2f5754a5c2427e15c7f4d604c309671750

SHA256
2021a9bb1862e2f7b80fca93ada4e65a858c6acdde38fbccfa6dc6d3d676deec

SHA512
71cfb13c470f48c3bac14132788e75f0d62428acd69854d9d9f8556a52f52f8716b73912b4f58bc8c93efcc4f6da582b6259848996692147269f19559aa59207

Download Submit
C:\Users\Admin\AppData\Local\Temp\g8635D\vsafe_setup.exe

Filesize
500KB

MD5
80acfba01b15107fb95a61131dc8a4f2

SHA1
605caa2f5754a5c2427e15c7f4d604c309671750

SHA256
2021a9bb1862e2f7b80fca93ada4e65a858c6acdde38fbccfa6dc6d3d676deec

SHA512
71cfb13c470f48c3bac14132788e75f0d62428acd69854d9d9f8556a52f52f8716b73912b4f58bc8c93efcc4f6da582b6259848996692147269f19559aa59207

Download Submit