Analysis
-
max time kernel
596s -
max time network
599s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03-03-2023 14:06
Static task
static1
Behavioral task
behavioral1
Sample
socks.exe
Resource
win7-20230220-en
General
-
Target
socks.exe
-
Size
420KB
-
MD5
e85fa08c1ed20440363e2e44eced6299
-
SHA1
e0867a371a5c6bfdf6bd84470b188f0817b4d23a
-
SHA256
c1f5b88413bef3bc89aacd544847d5690fe17247b10d5922e59e4cbc6c37707e
-
SHA512
73bc5a867c7b86f32257f43167c1816b9087a0fc6d70f1500194821abbdfcaddb4f79325e0b24837fabb9594284ff9bb7b180de5fc0264287a6345b146ffcfbf
-
SSDEEP
6144:g/v3nlCZp4WBAo8+zcJHZNIp4id9q/7ygt2k/BFi+Vrh+Z6QFn5EzMJ1:E/lppJHwp5e/viEg6z81
Malware Config
Extracted
systembc
31.222.238.58:4280
192.168.1.28:4280
Signatures
-
Drops startup file 1 IoCs
Processes:
socks.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pu5xtvhm.lnk socks.exe -
Executes dropped EXE 1 IoCs
Processes:
pu5xtvhm.exepid process 1976 pu5xtvhm.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1608 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
pu5xtvhm.exedescription pid process target process PID 1976 set thread context of 1944 1976 pu5xtvhm.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
socks.exepid process 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe 1704 socks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
socks.exepu5xtvhm.exedescription pid process Token: SeDebugPrivilege 1704 socks.exe Token: SeDebugPrivilege 1976 pu5xtvhm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
socks.execmd.exepu5xtvhm.exedescription pid process target process PID 1704 wrote to memory of 1608 1704 socks.exe cmd.exe PID 1704 wrote to memory of 1608 1704 socks.exe cmd.exe PID 1704 wrote to memory of 1608 1704 socks.exe cmd.exe PID 1704 wrote to memory of 1608 1704 socks.exe cmd.exe PID 1608 wrote to memory of 1400 1608 cmd.exe PING.EXE PID 1608 wrote to memory of 1400 1608 cmd.exe PING.EXE PID 1608 wrote to memory of 1400 1608 cmd.exe PING.EXE PID 1608 wrote to memory of 1400 1608 cmd.exe PING.EXE PID 1608 wrote to memory of 788 1608 cmd.exe PING.EXE PID 1608 wrote to memory of 788 1608 cmd.exe PING.EXE PID 1608 wrote to memory of 788 1608 cmd.exe PING.EXE PID 1608 wrote to memory of 788 1608 cmd.exe PING.EXE PID 1608 wrote to memory of 1976 1608 cmd.exe pu5xtvhm.exe PID 1608 wrote to memory of 1976 1608 cmd.exe pu5xtvhm.exe PID 1608 wrote to memory of 1976 1608 cmd.exe pu5xtvhm.exe PID 1608 wrote to memory of 1976 1608 cmd.exe pu5xtvhm.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe PID 1976 wrote to memory of 1944 1976 pu5xtvhm.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\socks.exe"C:\Users\Admin\AppData\Local\Temp\socks.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 44 > nul && copy "C:\Users\Admin\AppData\Local\Temp\socks.exe" "C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exe" && ping 127.0.0.1 -n 44 > nul && "C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 443⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 443⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exe"C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exeFilesize
420KB
MD5e85fa08c1ed20440363e2e44eced6299
SHA1e0867a371a5c6bfdf6bd84470b188f0817b4d23a
SHA256c1f5b88413bef3bc89aacd544847d5690fe17247b10d5922e59e4cbc6c37707e
SHA51273bc5a867c7b86f32257f43167c1816b9087a0fc6d70f1500194821abbdfcaddb4f79325e0b24837fabb9594284ff9bb7b180de5fc0264287a6345b146ffcfbf
-
C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exeFilesize
420KB
MD5e85fa08c1ed20440363e2e44eced6299
SHA1e0867a371a5c6bfdf6bd84470b188f0817b4d23a
SHA256c1f5b88413bef3bc89aacd544847d5690fe17247b10d5922e59e4cbc6c37707e
SHA51273bc5a867c7b86f32257f43167c1816b9087a0fc6d70f1500194821abbdfcaddb4f79325e0b24837fabb9594284ff9bb7b180de5fc0264287a6345b146ffcfbf
-
\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exeFilesize
420KB
MD5e85fa08c1ed20440363e2e44eced6299
SHA1e0867a371a5c6bfdf6bd84470b188f0817b4d23a
SHA256c1f5b88413bef3bc89aacd544847d5690fe17247b10d5922e59e4cbc6c37707e
SHA51273bc5a867c7b86f32257f43167c1816b9087a0fc6d70f1500194821abbdfcaddb4f79325e0b24837fabb9594284ff9bb7b180de5fc0264287a6345b146ffcfbf
-
memory/1704-54-0x0000000000BC0000-0x0000000000C2E000-memory.dmpFilesize
440KB
-
memory/1704-55-0x0000000000A20000-0x0000000000A60000-memory.dmpFilesize
256KB
-
memory/1704-56-0x00000000007D0000-0x000000000081A000-memory.dmpFilesize
296KB
-
memory/1704-57-0x0000000000320000-0x0000000000338000-memory.dmpFilesize
96KB
-
memory/1704-58-0x0000000000A20000-0x0000000000A60000-memory.dmpFilesize
256KB
-
memory/1704-60-0x0000000000A20000-0x0000000000A60000-memory.dmpFilesize
256KB
-
memory/1704-61-0x0000000000A20000-0x0000000000A60000-memory.dmpFilesize
256KB
-
memory/1704-62-0x0000000000A20000-0x0000000000A60000-memory.dmpFilesize
256KB
-
memory/1704-63-0x0000000000A20000-0x0000000000A60000-memory.dmpFilesize
256KB
-
memory/1944-80-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1944-81-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1944-88-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1944-87-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1944-86-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1944-85-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1944-84-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1944-83-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1944-82-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1976-76-0x0000000000FE0000-0x0000000001020000-memory.dmpFilesize
256KB
-
memory/1976-71-0x00000000011E0000-0x000000000124E000-memory.dmpFilesize
440KB
-
memory/1976-79-0x0000000000650000-0x0000000000656000-memory.dmpFilesize
24KB
-
memory/1976-78-0x0000000000630000-0x000000000064A000-memory.dmpFilesize
104KB
-
memory/1976-77-0x0000000000FE0000-0x0000000001020000-memory.dmpFilesize
256KB
-
memory/1976-72-0x0000000000FE0000-0x0000000001020000-memory.dmpFilesize
256KB
-
memory/1976-75-0x0000000000FE0000-0x0000000001020000-memory.dmpFilesize
256KB
-
memory/1976-74-0x0000000000FE0000-0x0000000001020000-memory.dmpFilesize
256KB
-
memory/1976-73-0x0000000000FE0000-0x0000000001020000-memory.dmpFilesize
256KB