Analysis
- max time kernel
502s - max time network
559s - platform
windows10-2004_x64 - resource
win10v2004-20221111-es - resource tags
- submitted
15/01/2023, 01:34
General
- Target working_attack.7z
- Size 925KB
- Sample230115-by7fcscb6w
- SHA256 db8eb8347ed084c3ee3707ad032743e350157abcaf2817e5f15777b20c554b7f
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
- Modifies registry class 36 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\working_attack.7z1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x330 0x2441⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\working_attack\" -spe -an -ai#7zMap7305:84:7zEvent155111⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\working_attack\45.exe"C:\Users\Admin\Desktop\working_attack\45.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /im chrome.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
45.exe
S.a3x
memory/4984-141-0x00000000064F0000-0x0000000006566000-memory.dmp
memory/4984-143-0x0000000007130000-0x000000000714E000-memory.dmp
memory/4984-138-0x0000000005910000-0x00000000059A2000-memory.dmp
memory/4984-139-0x0000000005890000-0x00000000058F6000-memory.dmp
memory/4984-140-0x0000000007170000-0x0000000007332000-memory.dmp
memory/4984-135-0x0000000001200000-0x00000000012A6000-memory.dmp
memory/4984-142-0x0000000007870000-0x0000000007D9C000-memory.dmp
memory/4984-137-0x0000000005DC0000-0x0000000006364000-memory.dmp
memory/4984-144-0x00000000076E0000-0x00000000077E2000-memory.dmp
memory/4984-145-0x00000000080A0000-0x00000000080B2000-memory.dmp
memory/4984-146-0x0000000008100000-0x000000000813C000-memory.dmp
memory/4984-147-0x00000000084C0000-0x00000000084E0000-memory.dmp
memory/4984-149-0x0000000008560000-0x00000000085B0000-memory.dmp