4af82e2942c843c88fd4dc43cfe11b9fc286c7ea1dac32bf4ee9de439eed07fd

Analysis

max time kernel
126s
max time network
128s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/12/2022, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d96604e0d1ab34d42d267783ade26fa.exe
Size 6.5MB
Sample221223-e5d9yaba4w
SHA256 4af82e2942c843c88fd4dc43cfe11b9fc286c7ea1dac32bf4ee9de439eed07fd
MD5 5d96604e0d1ab34d42d267783ade26fa
SHA1 5690c2fd39290c52656099dbaa6ab71645ef7fcf
SHA512 35e537e1a1ac8cfc5f8d042b5c26167fc7ffde7e27f349f6df23878cace3a550402c51ca3b0a0ea62ca0f284dba00a91f08cb25d11aea49dc5326a5331b47cf4
SSDEEP 196608:LzvolaY8aa303pN4r6IYxSb60nUWTX6m:/4aXaasE6IYYQU6m
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1920	svcupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
944	5d96604e0d1ab34d42d267783ade26fa.exe
1920	svcupdater.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1056	944	5d96604e0d1ab34d42d267783ade26fa.exe	28
PID 944 wrote to memory of 1056	944	5d96604e0d1ab34d42d267783ade26fa.exe	28
PID 944 wrote to memory of 1056	944	5d96604e0d1ab34d42d267783ade26fa.exe	28
PID 944 wrote to memory of 1056	944	5d96604e0d1ab34d42d267783ade26fa.exe	28
PID 1240 wrote to memory of 1920	1240	taskeng.exe	31
PID 1240 wrote to memory of 1920	1240	taskeng.exe	31
PID 1240 wrote to memory of 1920	1240	taskeng.exe	31
PID 1240 wrote to memory of 1920	1240	taskeng.exe	31
PID 1240 wrote to memory of 1920	1240	taskeng.exe	31
PID 1240 wrote to memory of 1920	1240	taskeng.exe	31
PID 1240 wrote to memory of 1920	1240	taskeng.exe	31

C:\Users\Admin\AppData\Local\Temp\5d96604e0d1ab34d42d267783ade26fa.exe
"C:\Users\Admin\AppData\Local\Temp\5d96604e0d1ab34d42d267783ade26fa.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Creates scheduled task(s)
  PID:1056

C:\Windows\system32\taskeng.exe
taskeng.exe {83A9CEF8-1EE0-4729-A1F3-A88DC9AD15A5} S-1-5-21-3385717845-2518323428-350143044-1000:SABDUHNY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
Size 699.5MB
SHA256 c7bf82f67a950614336d88e6e2aae60290a9177fa4b72935cdfaa1d16f1438e9
MD5 650ebb112ce8bea08244ba188c1c31ce
SHA1 1b68e77191d9083a2e8d9d2155fa1e746de88de0
SHA512 8efe4b927654fc79b9fa6169be9b57dd8af025ca3c4fec000b08e9b91fa3844bfe3732b75081258e3b243e4e6dfbe791764943cf7893865e3e5022fa27ee3126
SSDEEP 196608:LzvolaY8aa303pN4r6IYxSb60nUWTX6m+OcOcOcOcOcOcOcOcOcOcOcOcOcOcOcN:/4aXaasE6IYYQU6ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
Size 697.5MB
SHA256 be35a70fa303b3df6f6e459829f7915ae892aba8c54dcb65a7a62919a1109f76
MD5 57da96d0bbb37a0221dac8728013c9c4
SHA1 b5628e1895d605e71bc0762ff567a59c3f2fde29
SHA512 6340065cda71313a5243b817d4ebc7502d28adc2a0c3cdcb1af29bf122c200a535a5d9c3793d18ec5245d69cffc1436517dbe151c35194c0f5eb43cc4b8a2ed6
SSDEEP 196608:LzvolaY8aa303pN4r6IYxSb60nUWTX6m+OcOcOcOcOcOcOcOcOcOcOcOcOcOcOcW:/4aXaasE6IYYQU6m1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/944-54-0x0000000076411000-0x0000000076413000-memory.dmp

Download

memory/944-55-0x0000000000C00000-0x0000000001619000-memory.dmp

Download

memory/944-57-0x0000000000C00000-0x0000000001619000-memory.dmp

Download

memory/944-59-0x0000000000C00000-0x0000000001619000-memory.dmp

Download

memory/1920-64-0x0000000000870000-0x0000000001289000-memory.dmp

Download

memory/1920-67-0x0000000000870000-0x0000000001289000-memory.dmp

Download

memory/1920-66-0x0000000000870000-0x0000000001289000-memory.dmp

Download

memory/1920-68-0x0000000000870000-0x0000000001289000-memory.dmp

Download