Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
09/07/2023, 07:23
Behavioral task
behavioral1
Sample
855807f8c0224dexeexeexeex.exe
Resource
win7-20230703-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
855807f8c0224dexeexeexeex.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
855807f8c0224dexeexeexeex.exe
-
Size
73KB
-
MD5
855807f8c0224d013981e0d811993845
-
SHA1
aae385437f2809689d1b6d8cfe439963c5af78df
-
SHA256
f618bd835254976c60688bf29ae43e0a9388f535c8a35c254767018e80249ae2
-
SHA512
13f11a87bddca9a5a70f05066cf5090226de45bff7359669064024f1e174b177d60b6081a15ee65360103a160d0cd3e9fda571d54e4c297709024e632d1ccc00
-
SSDEEP
1536:Z55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:xMSjOnrmBTMqqDL2/mr3IdE8we0Avu5h
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\uvcvrulvnac = "C:\\Users\\Admin\\AppData\\Local\\Temp\\855807f8c0224dexeexeexeex.exe" 855807f8c0224dexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 855807f8c0224dexeexeexeex.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\F: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\I: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\J: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\N: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\O: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\T: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\U: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\Z: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\S: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\Y: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\B: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\M: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\E: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\G: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\H: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\K: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\L: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\P: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\Q: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\R: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\V: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\W: 855807f8c0224dexeexeexeex.exe File opened (read-only) \??\X: 855807f8c0224dexeexeexeex.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 855807f8c0224dexeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 855807f8c0224dexeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 855807f8c0224dexeexeexeex.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2964 855807f8c0224dexeexeexeex.exe 2964 855807f8c0224dexeexeexeex.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2276 2964 855807f8c0224dexeexeexeex.exe 30 PID 2964 wrote to memory of 2276 2964 855807f8c0224dexeexeexeex.exe 30 PID 2964 wrote to memory of 2276 2964 855807f8c0224dexeexeexeex.exe 30 PID 2964 wrote to memory of 2276 2964 855807f8c0224dexeexeexeex.exe 30 PID 2964 wrote to memory of 2332 2964 855807f8c0224dexeexeexeex.exe 32 PID 2964 wrote to memory of 2332 2964 855807f8c0224dexeexeexeex.exe 32 PID 2964 wrote to memory of 2332 2964 855807f8c0224dexeexeexeex.exe 32 PID 2964 wrote to memory of 2332 2964 855807f8c0224dexeexeexeex.exe 32 PID 2964 wrote to memory of 2256 2964 855807f8c0224dexeexeexeex.exe 34 PID 2964 wrote to memory of 2256 2964 855807f8c0224dexeexeexeex.exe 34 PID 2964 wrote to memory of 2256 2964 855807f8c0224dexeexeexeex.exe 34 PID 2964 wrote to memory of 2256 2964 855807f8c0224dexeexeexeex.exe 34 PID 2964 wrote to memory of 2348 2964 855807f8c0224dexeexeexeex.exe 36 PID 2964 wrote to memory of 2348 2964 855807f8c0224dexeexeexeex.exe 36 PID 2964 wrote to memory of 2348 2964 855807f8c0224dexeexeexeex.exe 36 PID 2964 wrote to memory of 2348 2964 855807f8c0224dexeexeexeex.exe 36 PID 2964 wrote to memory of 1416 2964 855807f8c0224dexeexeexeex.exe 38 PID 2964 wrote to memory of 1416 2964 855807f8c0224dexeexeexeex.exe 38 PID 2964 wrote to memory of 1416 2964 855807f8c0224dexeexeexeex.exe 38 PID 2964 wrote to memory of 1416 2964 855807f8c0224dexeexeexeex.exe 38 PID 2964 wrote to memory of 1200 2964 855807f8c0224dexeexeexeex.exe 40 PID 2964 wrote to memory of 1200 2964 855807f8c0224dexeexeexeex.exe 40 PID 2964 wrote to memory of 1200 2964 855807f8c0224dexeexeexeex.exe 40 PID 2964 wrote to memory of 1200 2964 855807f8c0224dexeexeexeex.exe 40 PID 2964 wrote to memory of 2420 2964 855807f8c0224dexeexeexeex.exe 42 PID 2964 wrote to memory of 2420 2964 855807f8c0224dexeexeexeex.exe 42 PID 2964 wrote to memory of 2420 2964 855807f8c0224dexeexeexeex.exe 42 PID 2964 wrote to memory of 2420 2964 855807f8c0224dexeexeexeex.exe 42 PID 2964 wrote to memory of 2124 2964 855807f8c0224dexeexeexeex.exe 44 PID 2964 wrote to memory of 2124 2964 855807f8c0224dexeexeexeex.exe 44 PID 2964 wrote to memory of 2124 2964 855807f8c0224dexeexeexeex.exe 44 PID 2964 wrote to memory of 2124 2964 855807f8c0224dexeexeexeex.exe 44 PID 2964 wrote to memory of 1732 2964 855807f8c0224dexeexeexeex.exe 46 PID 2964 wrote to memory of 1732 2964 855807f8c0224dexeexeexeex.exe 46 PID 2964 wrote to memory of 1732 2964 855807f8c0224dexeexeexeex.exe 46 PID 2964 wrote to memory of 1732 2964 855807f8c0224dexeexeexeex.exe 46 PID 2964 wrote to memory of 1716 2964 855807f8c0224dexeexeexeex.exe 48 PID 2964 wrote to memory of 1716 2964 855807f8c0224dexeexeexeex.exe 48 PID 2964 wrote to memory of 1716 2964 855807f8c0224dexeexeexeex.exe 48 PID 2964 wrote to memory of 1716 2964 855807f8c0224dexeexeexeex.exe 48 PID 2964 wrote to memory of 2664 2964 855807f8c0224dexeexeexeex.exe 50 PID 2964 wrote to memory of 2664 2964 855807f8c0224dexeexeexeex.exe 50 PID 2964 wrote to memory of 2664 2964 855807f8c0224dexeexeexeex.exe 50 PID 2964 wrote to memory of 2664 2964 855807f8c0224dexeexeexeex.exe 50 PID 2964 wrote to memory of 2620 2964 855807f8c0224dexeexeexeex.exe 52 PID 2964 wrote to memory of 2620 2964 855807f8c0224dexeexeexeex.exe 52 PID 2964 wrote to memory of 2620 2964 855807f8c0224dexeexeexeex.exe 52 PID 2964 wrote to memory of 2620 2964 855807f8c0224dexeexeexeex.exe 52 PID 2964 wrote to memory of 2808 2964 855807f8c0224dexeexeexeex.exe 54 PID 2964 wrote to memory of 2808 2964 855807f8c0224dexeexeexeex.exe 54 PID 2964 wrote to memory of 2808 2964 855807f8c0224dexeexeexeex.exe 54 PID 2964 wrote to memory of 2808 2964 855807f8c0224dexeexeexeex.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\855807f8c0224dexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\855807f8c0224dexeexeexeex.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2276
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2332
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2256
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2348
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:1416
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1200
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2420
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2124
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1732
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1716
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2664
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2620
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2808
-