f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5

Analysis

max time kernel
165s
max time network
171s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
Size

654KB
MD5

d1d7aadd8bf387753bd6c7501d943696
SHA1

7f8c251e26eeb2a932fbac229bfd471e053e4189
SHA256

f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5
SHA512

7f62d94f93de037c6abc36a7b971914409c1796a20dd20c67f43f7d6117f523f7a267a6e20120cb5faff94fc81a1b36c8381a8ccf1dc0a1f5b4208df42cd6430
SSDEEP

12288:h6Wq4aaE6KwyF5L0Y2D1PqLwelzrCW8Vwj/8Snw5CmzgpNrX:3thEVaPqLwex8e/dwEmsX

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1720	readme.exe
1984	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/788-55-0x0000000000400000-0x00000000004FA000-memory.dmp	upx
behavioral1/memory/788-65-0x0000000000400000-0x00000000004FA000-memory.dmp	upx

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read.vbs	WScript.exe

Loads dropped DLL 4 IoCs

pid	Process
788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
1720	readme.exe
1720	readme.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\read = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\read.vbs\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\read = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\read.vbs\""	WScript.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/788-55-0x0000000000400000-0x00000000004FA000-memory.dmp	autoit_exe
behavioral1/memory/788-65-0x0000000000400000-0x00000000004FA000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	readme.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1720	788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	28
PID 788 wrote to memory of 1720	788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	28
PID 788 wrote to memory of 1720	788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	28
PID 788 wrote to memory of 1720	788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	28
PID 788 wrote to memory of 1492	788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	29
PID 788 wrote to memory of 1492	788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	29
PID 788 wrote to memory of 1492	788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	29
PID 788 wrote to memory of 1492	788	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	29
PID 1720 wrote to memory of 1984	1720	readme.exe	31
PID 1720 wrote to memory of 1984	1720	readme.exe	31
PID 1720 wrote to memory of 1984	1720	readme.exe	31
PID 1720 wrote to memory of 1984	1720	readme.exe	31

C:\Users\Admin\AppData\Local\Temp\f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
"C:\Users\Admin\AppData\Local\Temp\f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\readme.exe
  C:\Users\Admin\AppData\Local\Temp/readme.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:1984
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\read.vbs"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\read.vbs

Filesize
108KB

MD5
60ce7fdcf0debaab00b74c84d5295c1f

SHA1
f76301f76220acd3611c14b1b6310c5600bb4497

SHA256
77c14d3a8a92498e479cb579e5cf0f0a397941f0266f1f178bc2a11a88c42cad

SHA512
58f828d8c124c0b1ab23830fc5f103a793ab31dddb9138dce2f1e21197cf027952da4358c54d89776c713edb12e83e93e0ca0709bb95aacbc61d1111f5112829

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
\Users\Admin\AppData\Local\Temp\readme.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
\Users\Admin\AppData\Local\Temp\readme.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
memory/788-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/788-55-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/788-65-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/1720-122-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-119-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-77-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-79-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-81-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-84-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-85-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-86-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-88-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-90-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-91-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-92-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-93-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-97-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-99-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-100-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-102-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-104-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-107-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-108-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-110-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-112-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-113-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-114-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-117-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-120-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-71-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-125-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-124-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-123-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-121-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-74-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-118-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-116-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-115-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-111-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-109-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-106-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-105-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-103-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-101-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-98-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-96-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-95-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-94-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-89-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-87-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-83-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-82-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-80-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-78-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-76-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-75-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-72-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-69-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-67-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-174-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-70-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-181-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-68-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1720-60-0x0000000000220000-0x000000000024C000-memory.dmp

Filesize
176KB

Download
memory/1984-185-0x0000000073110000-0x00000000736BB000-memory.dmp

Filesize
5.7MB

Download