Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
09/07/2023, 16:04
Behavioral task
behavioral1
Sample
827b3d921a6a25exeexeexeex.exe
Resource
win7-20230703-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
827b3d921a6a25exeexeexeex.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
827b3d921a6a25exeexeexeex.exe
-
Size
73KB
-
MD5
827b3d921a6a25fb0700834496930f3d
-
SHA1
527cc5fab83351774b2538c156bd8519cb0b7566
-
SHA256
553b3a83fce5ef6c97bd07a812d536324e2b792bd4c6da17a2a66cc1ca8b5ff6
-
SHA512
01c48112f1894ca4fc8fb176ab6decad71ecf082fcb655d95aea0d9296a9b688a7dd32e93c43948bcdd95a5a2ecbd3cab43dcec791948685be7198a8f3554af9
-
SSDEEP
1536:+gSeGDjtQhnwmmB0yjMqqUM2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv:+MSjOnrmBbMqqMmr3IdE8we0Avu5r++N
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 827b3d921a6a25exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\tfrzejtdaiy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\827b3d921a6a25exeexeexeex.exe" 827b3d921a6a25exeexeexeex.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\H: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\N: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\P: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\R: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\U: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\F: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\J: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\L: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\O: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\Q: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\Y: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\A: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\E: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\K: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\S: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\V: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\W: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\X: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\B: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\I: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\M: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\T: 827b3d921a6a25exeexeexeex.exe File opened (read-only) \??\Z: 827b3d921a6a25exeexeexeex.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 827b3d921a6a25exeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 827b3d921a6a25exeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 827b3d921a6a25exeexeexeex.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2352 827b3d921a6a25exeexeexeex.exe 2352 827b3d921a6a25exeexeexeex.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1688 2352 827b3d921a6a25exeexeexeex.exe 30 PID 2352 wrote to memory of 1688 2352 827b3d921a6a25exeexeexeex.exe 30 PID 2352 wrote to memory of 1688 2352 827b3d921a6a25exeexeexeex.exe 30 PID 2352 wrote to memory of 1688 2352 827b3d921a6a25exeexeexeex.exe 30 PID 2352 wrote to memory of 320 2352 827b3d921a6a25exeexeexeex.exe 32 PID 2352 wrote to memory of 320 2352 827b3d921a6a25exeexeexeex.exe 32 PID 2352 wrote to memory of 320 2352 827b3d921a6a25exeexeexeex.exe 32 PID 2352 wrote to memory of 320 2352 827b3d921a6a25exeexeexeex.exe 32 PID 2352 wrote to memory of 2456 2352 827b3d921a6a25exeexeexeex.exe 34 PID 2352 wrote to memory of 2456 2352 827b3d921a6a25exeexeexeex.exe 34 PID 2352 wrote to memory of 2456 2352 827b3d921a6a25exeexeexeex.exe 34 PID 2352 wrote to memory of 2456 2352 827b3d921a6a25exeexeexeex.exe 34 PID 2352 wrote to memory of 3060 2352 827b3d921a6a25exeexeexeex.exe 36 PID 2352 wrote to memory of 3060 2352 827b3d921a6a25exeexeexeex.exe 36 PID 2352 wrote to memory of 3060 2352 827b3d921a6a25exeexeexeex.exe 36 PID 2352 wrote to memory of 3060 2352 827b3d921a6a25exeexeexeex.exe 36 PID 2352 wrote to memory of 908 2352 827b3d921a6a25exeexeexeex.exe 38 PID 2352 wrote to memory of 908 2352 827b3d921a6a25exeexeexeex.exe 38 PID 2352 wrote to memory of 908 2352 827b3d921a6a25exeexeexeex.exe 38 PID 2352 wrote to memory of 908 2352 827b3d921a6a25exeexeexeex.exe 38 PID 2352 wrote to memory of 2784 2352 827b3d921a6a25exeexeexeex.exe 40 PID 2352 wrote to memory of 2784 2352 827b3d921a6a25exeexeexeex.exe 40 PID 2352 wrote to memory of 2784 2352 827b3d921a6a25exeexeexeex.exe 40 PID 2352 wrote to memory of 2784 2352 827b3d921a6a25exeexeexeex.exe 40 PID 2352 wrote to memory of 2208 2352 827b3d921a6a25exeexeexeex.exe 42 PID 2352 wrote to memory of 2208 2352 827b3d921a6a25exeexeexeex.exe 42 PID 2352 wrote to memory of 2208 2352 827b3d921a6a25exeexeexeex.exe 42 PID 2352 wrote to memory of 2208 2352 827b3d921a6a25exeexeexeex.exe 42 PID 2352 wrote to memory of 3012 2352 827b3d921a6a25exeexeexeex.exe 44 PID 2352 wrote to memory of 3012 2352 827b3d921a6a25exeexeexeex.exe 44 PID 2352 wrote to memory of 3012 2352 827b3d921a6a25exeexeexeex.exe 44 PID 2352 wrote to memory of 3012 2352 827b3d921a6a25exeexeexeex.exe 44 PID 2352 wrote to memory of 748 2352 827b3d921a6a25exeexeexeex.exe 46 PID 2352 wrote to memory of 748 2352 827b3d921a6a25exeexeexeex.exe 46 PID 2352 wrote to memory of 748 2352 827b3d921a6a25exeexeexeex.exe 46 PID 2352 wrote to memory of 748 2352 827b3d921a6a25exeexeexeex.exe 46 PID 2352 wrote to memory of 2644 2352 827b3d921a6a25exeexeexeex.exe 48 PID 2352 wrote to memory of 2644 2352 827b3d921a6a25exeexeexeex.exe 48 PID 2352 wrote to memory of 2644 2352 827b3d921a6a25exeexeexeex.exe 48 PID 2352 wrote to memory of 2644 2352 827b3d921a6a25exeexeexeex.exe 48 PID 2352 wrote to memory of 2792 2352 827b3d921a6a25exeexeexeex.exe 50 PID 2352 wrote to memory of 2792 2352 827b3d921a6a25exeexeexeex.exe 50 PID 2352 wrote to memory of 2792 2352 827b3d921a6a25exeexeexeex.exe 50 PID 2352 wrote to memory of 2792 2352 827b3d921a6a25exeexeexeex.exe 50 PID 2352 wrote to memory of 2652 2352 827b3d921a6a25exeexeexeex.exe 52 PID 2352 wrote to memory of 2652 2352 827b3d921a6a25exeexeexeex.exe 52 PID 2352 wrote to memory of 2652 2352 827b3d921a6a25exeexeexeex.exe 52 PID 2352 wrote to memory of 2652 2352 827b3d921a6a25exeexeexeex.exe 52 PID 2352 wrote to memory of 2872 2352 827b3d921a6a25exeexeexeex.exe 54 PID 2352 wrote to memory of 2872 2352 827b3d921a6a25exeexeexeex.exe 54 PID 2352 wrote to memory of 2872 2352 827b3d921a6a25exeexeexeex.exe 54 PID 2352 wrote to memory of 2872 2352 827b3d921a6a25exeexeexeex.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\827b3d921a6a25exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\827b3d921a6a25exeexeexeex.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1688
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:320
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2456
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3060
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:908
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2784
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2208
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:3012
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:748
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2644
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2792
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2652
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2872
-