5cc899a8dd9072ce72a49004c5b9f7cc074e4e7c4088fa89b25767182976e31e

Analysis

max time kernel
151s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/02/2023, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe
Size 2.0MB
Sample230206-h2phaace56
SHA256 5cc899a8dd9072ce72a49004c5b9f7cc074e4e7c4088fa89b25767182976e31e
MD5 685e09188fe4d448e0f1cfc33095a817
SHA1 b2ae259113dc8814b2b9cb1f9965a6396423532b
SHA512 b132bcbc230fc947c5fe74fe3548e4f9d8cbd2c6dd7f7b176f5d24b860df4e34433ea96605d02c923c4519ec0a94328488a85203954b9a914e669012b56361fb
SSDEEP 49152:B/dgqYkY8zrTtEBP/OlsLzFmNfW6FJKxxfZA4G:rYh8zuBP/OlsLzFmNfW6FJKxxfZA4G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ink.lnk	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ink.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ink.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
700	PING.EXE
980	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2016	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe
2016	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe
2016	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1316	2016	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe	27
PID 2016 wrote to memory of 1316	2016	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe	27
PID 2016 wrote to memory of 1316	2016	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe	27
PID 2016 wrote to memory of 1316	2016	Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe	27
PID 1316 wrote to memory of 700	1316	cmd.exe	29
PID 1316 wrote to memory of 700	1316	cmd.exe	29
PID 1316 wrote to memory of 700	1316	cmd.exe	29
PID 1316 wrote to memory of 700	1316	cmd.exe	29
PID 1316 wrote to memory of 980	1316	cmd.exe	30
PID 1316 wrote to memory of 980	1316	cmd.exe	30
PID 1316 wrote to memory of 980	1316	cmd.exe	30
PID 1316 wrote to memory of 980	1316	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe
"C:\Users\Admin\AppData\Local\Temp\Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 45 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Outward_QATCH_Transfer_QATCHOutward_Supplier_Payment_Supplier_Payment_31CBQA0000000045805857940_1500.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ink.exe" && ping 127.0.0.1 -n 45 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ink.exe"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 45
    3⤵
    - Runs ping.exe
    PID:700
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 45
    3⤵
    - Runs ping.exe
    PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000000970000-0x0000000000B72000-memory.dmp

Download

memory/2016-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Download

memory/2016-56-0x0000000000940000-0x0000000000974000-memory.dmp

Download

memory/2016-57-0x0000000000810000-0x0000000000828000-memory.dmp

Download