Analysis
-
max time kernel
108s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-04-2023 11:04
Static task
static1
Behavioral task
behavioral1
Sample
9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe
Resource
win7-20230220-en
General
-
Target
9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe
-
Size
3.1MB
-
MD5
1764990523d5dd6c063275abde06d3da
-
SHA1
fed5a57022bf7e25b5008b85b249c1046d28f6d0
-
SHA256
9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131
-
SHA512
b5f3aee2ef8e815ce20a0fa0ace3a1b8cedc6e01b9f0305702b619c6eb98e263c85c756b10869ada7b010ff5e25235d1cdd582a11b2656917cc37874afb0e9e9
-
SSDEEP
49152:amlQxq/9pIzOIlZKfB0rDM0GXCQuSJHC8zV:qc0l8WrzkCQugi0V
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1364 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
FJSBG.exepid process 1332 FJSBG.exe -
Loads dropped DLL 1 IoCs
Processes:
9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exepid process 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1984 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exepid process 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1984 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.execmd.exedescription pid process target process PID 1428 wrote to memory of 1332 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe FJSBG.exe PID 1428 wrote to memory of 1332 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe FJSBG.exe PID 1428 wrote to memory of 1332 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe FJSBG.exe PID 1428 wrote to memory of 1332 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe FJSBG.exe PID 1428 wrote to memory of 1364 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe cmd.exe PID 1428 wrote to memory of 1364 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe cmd.exe PID 1428 wrote to memory of 1364 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe cmd.exe PID 1428 wrote to memory of 1364 1428 9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe cmd.exe PID 1364 wrote to memory of 1984 1364 cmd.exe taskkill.exe PID 1364 wrote to memory of 1984 1364 cmd.exe taskkill.exe PID 1364 wrote to memory of 1984 1364 cmd.exe taskkill.exe PID 1364 wrote to memory of 1984 1364 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe"C:\Users\Admin\AppData\Local\Temp\9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\FJSBG.exe
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "9b6bf6b18292879d45cbd5ed83ac14f088484299fcdcf5d382a2acf5e6887131.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\dll[2].htmFilesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\FJSBG.exeFilesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\FJSBG.exeFilesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
memory/1428-54-0x0000000000400000-0x0000000001514000-memory.dmpFilesize
17.1MB
-
memory/1428-55-0x0000000000400000-0x0000000001514000-memory.dmpFilesize
17.1MB
-
memory/1428-61-0x0000000000400000-0x0000000001514000-memory.dmpFilesize
17.1MB
-
memory/1428-68-0x0000000010000000-0x000000001001B000-memory.dmpFilesize
108KB
-
memory/1428-72-0x0000000000400000-0x0000000001514000-memory.dmpFilesize
17.1MB
-
memory/1428-88-0x0000000000400000-0x0000000001514000-memory.dmpFilesize
17.1MB