Analysis

  • max time kernel
    148s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25/02/2023, 14:44

General

  • Target

    E&V - PO.61370025177.exe

  • Size

    903KB

  • MD5

    cc2e6a027d9a95e1b2df73f1b0350107

  • SHA1

    0d0899b4940db158978fa66d92e40e0c013d3e1d

  • SHA256

    e9575a5decf464c96451e7e6f2f4a12e2c0f96729bc25885507913ede49cb784

  • SHA512

    33721debe49429d2b561add911f7e03d916e9a5990fdda7e0ea4ede1f911b0d723d41a9cb0721066b64ce784604671b0ec63bcc118c1632da6601f3d9347747a

  • SSDEEP

    24576:j9JiT/gnOmk/3T911111111111111dODiRu4N:2gny11111111111111GiR5

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\E&V - PO.61370025177.exe
    "C:\Users\Admin\AppData\Local\Temp\E&V - PO.61370025177.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\Admin\AppData\Local\Temp\E&V - PO.61370025177.exe" "C:\Users\Admin\AppData\Roaming\kdiurdjk.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\Admin\AppData\Roaming\kdiurdjk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:512
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 17
        3⤵
        • Runs ping.exe
        PID:2016
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 17
        3⤵
        • Runs ping.exe
        PID:1108
      • C:\Users\Admin\AppData\Roaming\kdiurdjk.exe
        "C:\Users\Admin\AppData\Roaming\kdiurdjk.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          4⤵
            PID:432
          • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe
            "C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1044
            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe
              "C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:884

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe

            Filesize

            76KB

            MD5

            0e362e7005823d0bec3719b902ed6d62

            SHA1

            590d860b909804349e0cdc2f1662b37bd62f7463

            SHA256

            2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

            SHA512

            518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

          • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe

            Filesize

            76KB

            MD5

            0e362e7005823d0bec3719b902ed6d62

            SHA1

            590d860b909804349e0cdc2f1662b37bd62f7463

            SHA256

            2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

            SHA512

            518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

          • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe

            Filesize

            76KB

            MD5

            0e362e7005823d0bec3719b902ed6d62

            SHA1

            590d860b909804349e0cdc2f1662b37bd62f7463

            SHA256

            2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

            SHA512

            518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

          • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.txt

            Filesize

            56B

            MD5

            9e319cbe777ecae1ee1887e2de877c4d

            SHA1

            d29eac8a59db410f78e411ebb50b6f0a88278956

            SHA256

            356fdbad92662ebc2d37cf17b5c9d43a8603c85d87ede57ec60c865f7c0d4b51

            SHA512

            6041d8191e95dd71ae5c50f4fb7d98f012ed2d6f4f7ea291e4a9f129a8eb556f5f58aad0e3088ae37d3ca8b8907edabb52ea869b0b5153b17f3585b1cf2e7419

          • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.txt

            Filesize

            56B

            MD5

            9e319cbe777ecae1ee1887e2de877c4d

            SHA1

            d29eac8a59db410f78e411ebb50b6f0a88278956

            SHA256

            356fdbad92662ebc2d37cf17b5c9d43a8603c85d87ede57ec60c865f7c0d4b51

            SHA512

            6041d8191e95dd71ae5c50f4fb7d98f012ed2d6f4f7ea291e4a9f129a8eb556f5f58aad0e3088ae37d3ca8b8907edabb52ea869b0b5153b17f3585b1cf2e7419

          • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.txt

            Filesize

            54B

            MD5

            7d075c70b0166f4e2b600fadcbf5913f

            SHA1

            2f6df8024ff20201252a0719d34b5c846c82ed4a

            SHA256

            b7e9a859acbc41dc53c4aca48bcd4daf9e444dae230558675a310cba06f7e4c2

            SHA512

            a2f6430db7aa2aece8119be80e52b831f0f0a8dd133539f85729fded2e02196fdec40ede18e0f0e6464357ba99fa5aac33596f90df5c37980d2b016166cedbce

          • C:\Users\Admin\AppData\Roaming\kdiurdjk.exe

            Filesize

            903KB

            MD5

            cc2e6a027d9a95e1b2df73f1b0350107

            SHA1

            0d0899b4940db158978fa66d92e40e0c013d3e1d

            SHA256

            e9575a5decf464c96451e7e6f2f4a12e2c0f96729bc25885507913ede49cb784

            SHA512

            33721debe49429d2b561add911f7e03d916e9a5990fdda7e0ea4ede1f911b0d723d41a9cb0721066b64ce784604671b0ec63bcc118c1632da6601f3d9347747a

          • C:\Users\Admin\AppData\Roaming\kdiurdjk.exe

            Filesize

            903KB

            MD5

            cc2e6a027d9a95e1b2df73f1b0350107

            SHA1

            0d0899b4940db158978fa66d92e40e0c013d3e1d

            SHA256

            e9575a5decf464c96451e7e6f2f4a12e2c0f96729bc25885507913ede49cb784

            SHA512

            33721debe49429d2b561add911f7e03d916e9a5990fdda7e0ea4ede1f911b0d723d41a9cb0721066b64ce784604671b0ec63bcc118c1632da6601f3d9347747a

          • \Users\Admin\AppData\Local\Temp\Xapfnzes.exe

            Filesize

            76KB

            MD5

            0e362e7005823d0bec3719b902ed6d62

            SHA1

            590d860b909804349e0cdc2f1662b37bd62f7463

            SHA256

            2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

            SHA512

            518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

          • \Users\Admin\AppData\Local\Temp\Xapfnzes.exe

            Filesize

            76KB

            MD5

            0e362e7005823d0bec3719b902ed6d62

            SHA1

            590d860b909804349e0cdc2f1662b37bd62f7463

            SHA256

            2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

            SHA512

            518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

          • \Users\Admin\AppData\Roaming\kdiurdjk.exe

            Filesize

            903KB

            MD5

            cc2e6a027d9a95e1b2df73f1b0350107

            SHA1

            0d0899b4940db158978fa66d92e40e0c013d3e1d

            SHA256

            e9575a5decf464c96451e7e6f2f4a12e2c0f96729bc25885507913ede49cb784

            SHA512

            33721debe49429d2b561add911f7e03d916e9a5990fdda7e0ea4ede1f911b0d723d41a9cb0721066b64ce784604671b0ec63bcc118c1632da6601f3d9347747a

          • memory/432-88-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/432-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/432-85-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/432-74-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/432-75-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/432-76-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/432-77-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/432-78-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/432-79-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/432-80-0x0000000000400000-0x000000000055C000-memory.dmp

            Filesize

            1.4MB

          • memory/1044-95-0x0000000000300000-0x000000000031A000-memory.dmp

            Filesize

            104KB

          • memory/1228-83-0x0000000004F30000-0x0000000004F70000-memory.dmp

            Filesize

            256KB

          • memory/1228-69-0x0000000004F30000-0x0000000004F70000-memory.dmp

            Filesize

            256KB

          • memory/1228-71-0x0000000004F30000-0x0000000004F70000-memory.dmp

            Filesize

            256KB

          • memory/1228-84-0x0000000004F30000-0x0000000004F70000-memory.dmp

            Filesize

            256KB

          • memory/1228-73-0x0000000000560000-0x0000000000566000-memory.dmp

            Filesize

            24KB

          • memory/1228-72-0x0000000004600000-0x000000000461A000-memory.dmp

            Filesize

            104KB

          • memory/1228-70-0x0000000004F30000-0x0000000004F70000-memory.dmp

            Filesize

            256KB

          • memory/1228-82-0x0000000004F30000-0x0000000004F70000-memory.dmp

            Filesize

            256KB

          • memory/1228-68-0x0000000000920000-0x0000000000A08000-memory.dmp

            Filesize

            928KB

          • memory/1712-54-0x0000000000210000-0x00000000002F8000-memory.dmp

            Filesize

            928KB

          • memory/1712-59-0x00000000003C0000-0x0000000000400000-memory.dmp

            Filesize

            256KB

          • memory/1712-58-0x00000000003C0000-0x0000000000400000-memory.dmp

            Filesize

            256KB

          • memory/1712-57-0x0000000000410000-0x0000000000428000-memory.dmp

            Filesize

            96KB

          • memory/1712-56-0x0000000005010000-0x000000000505A000-memory.dmp

            Filesize

            296KB

          • memory/1712-55-0x00000000003C0000-0x0000000000400000-memory.dmp

            Filesize

            256KB