Analysis
-
max time kernel
19s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 15:59
Behavioral task
behavioral1
Sample
e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
-
Target
e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe
-
Size
164KB
-
MD5
b7b381eb309c01d468d3a88d91870c7a
-
SHA1
d43c553479b6929abc98a04db0022fc3091431b4
-
SHA256
e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61
-
SHA512
c00c02b72d558778cc8470e03bb8c738e87081be51c20237d7ab823f83eeec846bede1e20a954eefcd184cbe28748a85f2cc7c94dd928bebe06ccae3fad888f4
-
SSDEEP
3072:2aJTm6MaNm+DhIy6rZhwOZNHja5NjAzc9gTCsDS56zfmw5hfDkK:2aIfal2y6rTNDarmc9wS56Cig
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "0" e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe -
resource yara_rule behavioral1/memory/884-55-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/884-57-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/980-59-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/980-60-0x0000000000400000-0x0000000000472000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "0" e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 884 wrote to memory of 980 884 e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe 27 PID 884 wrote to memory of 980 884 e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe 27 PID 884 wrote to memory of 980 884 e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe 27 PID 884 wrote to memory of 980 884 e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe 27 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "0" e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe"C:\Users\Admin\AppData\Local\Temp\e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe"C:\Users\Admin\AppData\Local\Temp\e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe" Administrator2⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:980
-