cb751923695b52f799d7c20ca696069059187258021c9d8f8035e83180e8087d

Analysis

max time kernel
58s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe
Size

1.8MB
MD5

afe2eeb9c39fe0aaf3b98b1a570fd77c
SHA1

ca42099bfeafd1a5c79180e0b406679eb5cae47d
SHA256

cb751923695b52f799d7c20ca696069059187258021c9d8f8035e83180e8087d
SHA512

0a15dc447ab97a2129c3d4fddac9b1f6473e5108275053961baf0f4a36a78b50583ee675a1753a300ac9a90cf01447353ca69bba845aa7a78294b1e381969243
SSDEEP

49152:t5+hFlevtNUzY7WawmPzyxMAqpDHd5h419Pu0hO/k5:t5aFlevtw9uzCMdBf4xVhOY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
776	Negli.com
268	Negli.com

Loads dropped DLL 2 IoCs

pid	Process
1708	cmd.exe
776	Negli.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1104	PING.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1808	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1808	AUDIODG.EXE
Token: 33	1808	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1808	AUDIODG.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2032	1476	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	27
PID 1476 wrote to memory of 2032	1476	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	27
PID 1476 wrote to memory of 2032	1476	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	27
PID 1476 wrote to memory of 2032	1476	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	27
PID 1476 wrote to memory of 1980	1476	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	29
PID 1476 wrote to memory of 1980	1476	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	29
PID 1476 wrote to memory of 1980	1476	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	29
PID 1476 wrote to memory of 1980	1476	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	29
PID 1980 wrote to memory of 1708	1980	cmd.exe	31
PID 1980 wrote to memory of 1708	1980	cmd.exe	31
PID 1980 wrote to memory of 1708	1980	cmd.exe	31
PID 1980 wrote to memory of 1708	1980	cmd.exe	31
PID 1708 wrote to memory of 1888	1708	cmd.exe	32
PID 1708 wrote to memory of 1888	1708	cmd.exe	32
PID 1708 wrote to memory of 1888	1708	cmd.exe	32
PID 1708 wrote to memory of 1888	1708	cmd.exe	32
PID 1708 wrote to memory of 776	1708	cmd.exe	33
PID 1708 wrote to memory of 776	1708	cmd.exe	33
PID 1708 wrote to memory of 776	1708	cmd.exe	33
PID 1708 wrote to memory of 776	1708	cmd.exe	33
PID 1708 wrote to memory of 1104	1708	cmd.exe	34
PID 1708 wrote to memory of 1104	1708	cmd.exe	34
PID 1708 wrote to memory of 1104	1708	cmd.exe	34
PID 1708 wrote to memory of 1104	1708	cmd.exe	34
PID 776 wrote to memory of 268	776	Negli.com	35
PID 776 wrote to memory of 268	776	Negli.com	35
PID 776 wrote to memory of 268	776	Negli.com	35
PID 776 wrote to memory of 268	776	Negli.com	35

C:\Users\Admin\AppData\Local\Temp\._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo XtGExU
  2⤵
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Altezza.mpeg
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^lAbNkOShiVjJRNtfJIzMjyQMVxTwAkDFIexxkoUhUizBsGTCjfGOnbgtJLRQUQNVsHqPaJtBNyRtMfcfBsOlFPukNdKmdratxbpJFrpDlyqzFlaxdCfD$" Seguente.mp3
      4⤵
      PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com
      Negli.com Uno.pptx
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com
        
        C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com Uno.pptx
        5⤵
        Executes dropped EXE
        
        PID:268
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:1104

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Altezza.mpeg

Filesize
108KB

MD5
2a844be752dd3f88eb8fde52cc17eb93

SHA1
16566b1e6de6c561163bd70a78d0b5e3e80ecd8c

SHA256
ab34e814b57599376c9fecdc4204c82673bb2b17d5fe9d1f4d3de3e1eecf08c1

SHA512
a98fcdb9be93342539cd6c356f89ffaba14d6b9c8ad3b4436897ea4bbf5c2f373e7708d32edf216a5892849c1946f18767b0142c234a5036d319d601bcfd293c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Osi.accdb

Filesize
888KB

MD5
3e4a7482443e38011d4aaa0d47df63a4

SHA1
8357eedda93630634d0b06398354ac17a2f7e68f

SHA256
fb5be8cdcdad4a8b8879fbe39b7b6547219e1c0b1e087ff49c5c82b20cab74e9

SHA512
e12413b37ef61090d5a542d9ad85db6383d8a3c437d0e7e2582fcb4944e9c47f7e126ffc4fceeedfa60eb47802668874cb5317f3f9b22ee9849650eb1bc6825e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Seguente.mp3

Filesize
921KB

MD5
dff7a2df04830caeefb707eb16347978

SHA1
b246254d21482c383097d0dc5a0073d64a7b99b7

SHA256
421b0ef0e2d2a87b9afe1bcd7b3a3ca0eda311ee4a3a93c4d72e7c18acf5c490

SHA512
96ae714f2be8166f19ff3a3c9a250e0b12b0fa02b29e0d1f305e74e3f8d88e0f7c9a9b63a37add2caab72cf28c42cb1126098ce91348ca5de86d8a7e9a8611a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Uno.pptx

Filesize
696KB

MD5
a23ec366a0caa4e8a15e9c890076ac93

SHA1
a4d0cedc500237fcde5e616931ab10e5909cd789

SHA256
8872a4b96f95e298893f6242c993ad18d59d8ecdbb5addec72ce3c94caf0d9c5

SHA512
f63ccd65ffb1a23d2cebff458a6d4c7c706f8673f74c97d92d46676546b99780d92c778b7ff070d88caffd9ab4d47df69e279e8223be5b2f6802aad7c43ad286

Download Submit
\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
memory/1476-54-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1640-73-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Filesize
8KB

Download