Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe
-
Size
348KB
-
MD5
3ec6b3568b70dd0286fb5f1fc73ea408
-
SHA1
f0af37c9196a46ef7c9ae4347b13c5c720193747
-
SHA256
bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7
-
SHA512
051e8781e425361bac5a3a722d52e9bf187ee5f40f9066ef09223e995e5b92d1334a8adafa75fe0ccb8ef241d34b19acfc60c7694ecedd8b2aeb2e84c16742e7
-
SSDEEP
3072:SYbDXo+kkXT2d3aJg2GjxOvFRr42kmDb6pI32pIyIMLYdkWGqzjTA1ADzMCXQaNp:Z/0qTn9J4LmDuvayK1Gqzi0X7j
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sychost.exe" bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sychost.exe bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Windows\SysWOW64\sychost.exe bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe -
Drops file in Program Files directory 58 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\kk.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\History.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\7z.exe bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\7zG.exe bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1572 bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe 1572 bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe 1572 bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe 1572 bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe 1572 bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe 1572 bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe 1572 bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe 1572 bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe"C:\Users\Admin\AppData\Local\Temp\bc01933cbf29a8bc129e4e7c6465f6a02d2fc071352d4b82678fdc2d3b56f2d7.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1572