Overview
overview
10Static
static
102d640e53d6...02.exe
windows10-1703-x64
102d640e53d6...02.exe
windows7-x64
102d640e53d6...02.exe
windows10-2004-x64
1095de56b7b2...57.exe
windows10-1703-x64
1095de56b7b2...57.exe
windows7-x64
1095de56b7b2...57.exe
windows10-2004-x64
10d950b50f5f...4e.exe
windows10-1703-x64
10d950b50f5f...4e.exe
windows7-x64
10d950b50f5f...4e.exe
windows10-2004-x64
10d62c1f65b0...b4.exe
windows10-1703-x64
10d62c1f65b0...b4.exe
windows7-x64
10d62c1f65b0...b4.exe
windows10-2004-x64
10Resubmissions
25-12-2022 14:22
221225-rppf7abf39 1025-12-2022 14:22
221225-rpkg8seg4s 1025-12-2022 14:21
221225-rpexraeg31 1025-12-2022 14:21
221225-rn92haeg3z 1025-12-2022 14:13
221225-rjx65seg3w 10Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-12-2022 14:13
Behavioral task
behavioral1
Sample
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Resource
win10-20220901-en
Behavioral task
behavioral2
Sample
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Resource
win7-20220812-en
Behavioral task
behavioral3
Sample
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
d950b50f5f6430bec1db8de9f36b9a4e.exe
Resource
win10-20220812-en
Behavioral task
behavioral8
Sample
d950b50f5f6430bec1db8de9f36b9a4e.exe
Resource
win7-20221111-en
Behavioral task
behavioral9
Sample
d950b50f5f6430bec1db8de9f36b9a4e.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral10
Sample
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe
Resource
win10-20220901-en
Behavioral task
behavioral11
Sample
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe
Resource
win7-20221111-en
General
-
Target
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
-
Size
850KB
-
MD5
f183d934a954fc80602a9173f55f22c9
-
SHA1
a472c526f1dec0eb9bccdf2e083171a176faf1c4
-
SHA256
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57
-
SHA512
48d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24
-
SSDEEP
12288:jYmzPxoepv5EUOPri4BTVUDnV89SxP3ol8VU9o:/xoS6TjUDnlP3G9o
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4064 MoUSO.exe 868 MoUSO.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5004 set thread context of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2344 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 4064 MoUSO.exe 4064 MoUSO.exe 4064 MoUSO.exe 4064 MoUSO.exe 4064 MoUSO.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe Token: SeDebugPrivilege 4064 MoUSO.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 4132 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 67 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 5004 wrote to memory of 3392 5004 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 68 PID 3392 wrote to memory of 2344 3392 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 69 PID 3392 wrote to memory of 2344 3392 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 69 PID 3392 wrote to memory of 2344 3392 95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe 69 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 868 4064 MoUSO.exe 72 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73 PID 4064 wrote to memory of 4876 4064 MoUSO.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"2⤵PID:4132
-
-
C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"3⤵
- Creates scheduled task(s)
PID:2344
-
-
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeC:\Users\Admin\AppData\Local\cache\MoUSO.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\cache\MoUSO.exe"C:\Users\Admin\AppData\Local\cache\MoUSO.exe"2⤵
- Executes dropped EXE
PID:868
-
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exe"C:\Users\Admin\AppData\Local\cache\MoUSO.exe"2⤵PID:4876
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
850KB
MD5f183d934a954fc80602a9173f55f22c9
SHA1a472c526f1dec0eb9bccdf2e083171a176faf1c4
SHA25695de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57
SHA51248d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24
-
Filesize
850KB
MD5f183d934a954fc80602a9173f55f22c9
SHA1a472c526f1dec0eb9bccdf2e083171a176faf1c4
SHA25695de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57
SHA51248d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24
-
Filesize
850KB
MD5f183d934a954fc80602a9173f55f22c9
SHA1a472c526f1dec0eb9bccdf2e083171a176faf1c4
SHA25695de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57
SHA51248d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24