Overview
overview
10Static
static
38200755cbe...33.exe
windows7-x64
88200755cbe...33.exe
windows10-2004-x64
829c7e87350...5b.exe
windows7-x64
129c7e87350...5b.exe
windows10-2004-x64
149cccd30a5...90.exe
windows7-x64
149cccd30a5...90.exe
windows10-2004-x64
1b17911ddea...82.exe
windows7-x64
1b17911ddea...82.exe
windows10-2004-x64
102ca4397da...51.exe
windows7-x64
102ca4397da...51.exe
windows10-2004-x64
1022aeb126d...74.exe
windows7-x64
9022aeb126d...74.exe
windows10-2004-x64
9smb-7teux2sm.exe
windows7-x64
9smb-7teux2sm.exe
windows10-2004-x64
9smb-onil0o36.exe
windows7-x64
9smb-onil0o36.exe
windows10-2004-x64
9malware-sa...ab.exe
windows7-x64
10malware-sa...ab.exe
windows10-2004-x64
10malware-sa...1).exe
windows7-x64
6malware-sa...1).exe
windows10-2004-x64
6malware-sa...n.xlsx
windows7-x64
1malware-sa...n.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-03-2024 12:57
Static task
static1
Behavioral task
behavioral1
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
smb-7teux2sm.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
smb-7teux2sm.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
smb-onil0o36.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
smb-onil0o36.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win10v2004-20240226-en
General
-
Target
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
-
Size
1.4MB
-
MD5
f2e1d236c5d2c009e1749fc6479a9ede
-
SHA1
262c22ffd66c33da641558f3da23f7584881a782
-
SHA256
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233
-
SHA512
3b3174ac17e377028accf1ebfd6bd6ae97fc99c4e7814f8ad0fe707dc77d757f26d667333efb495a9b9768d49672737233c88d7a50b4dc81ad170f068ad95cc1
-
SSDEEP
24576:6EpKGrwKydag/jU7IZK8LNmf2+r+eauoUWg6ye2tX9t5WR4MJh:6nGrwKtg7U7I88Zi2/xxyeAt06a
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 4 IoCs
pid Process 2132 netsh.exe 1544 netsh.exe 1072 netsh.exe 592 netsh.exe -
Stops running service(s) 3 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\id.txt wuauser.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2832 sc.exe 2340 sc.exe -
Kills process with taskkill 7 IoCs
pid Process 2444 taskkill.exe 828 taskkill.exe 3052 taskkill.exe 2548 taskkill.exe 2464 taskkill.exe 2384 taskkill.exe 1496 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe 2088 wuauser.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2548 taskkill.exe Token: SeDebugPrivilege 2464 taskkill.exe Token: SeDebugPrivilege 2384 taskkill.exe Token: SeDebugPrivilege 1496 taskkill.exe Token: SeDebugPrivilege 2444 taskkill.exe Token: SeDebugPrivilege 828 taskkill.exe Token: SeDebugPrivilege 3052 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2900 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 28 PID 2628 wrote to memory of 2900 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 28 PID 2628 wrote to memory of 2900 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 28 PID 2628 wrote to memory of 2900 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 28 PID 2900 wrote to memory of 2548 2900 cmd.exe 30 PID 2900 wrote to memory of 2548 2900 cmd.exe 30 PID 2900 wrote to memory of 2548 2900 cmd.exe 30 PID 2900 wrote to memory of 2548 2900 cmd.exe 30 PID 2628 wrote to memory of 2616 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 32 PID 2628 wrote to memory of 2616 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 32 PID 2628 wrote to memory of 2616 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 32 PID 2628 wrote to memory of 2616 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 32 PID 2616 wrote to memory of 2464 2616 cmd.exe 34 PID 2616 wrote to memory of 2464 2616 cmd.exe 34 PID 2616 wrote to memory of 2464 2616 cmd.exe 34 PID 2616 wrote to memory of 2464 2616 cmd.exe 34 PID 2628 wrote to memory of 2424 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 35 PID 2628 wrote to memory of 2424 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 35 PID 2628 wrote to memory of 2424 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 35 PID 2628 wrote to memory of 2424 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 35 PID 2424 wrote to memory of 2832 2424 cmd.exe 37 PID 2424 wrote to memory of 2832 2424 cmd.exe 37 PID 2424 wrote to memory of 2832 2424 cmd.exe 37 PID 2424 wrote to memory of 2832 2424 cmd.exe 37 PID 2628 wrote to memory of 2800 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 38 PID 2628 wrote to memory of 2800 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 38 PID 2628 wrote to memory of 2800 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 38 PID 2628 wrote to memory of 2800 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 38 PID 2800 wrote to memory of 2340 2800 cmd.exe 40 PID 2800 wrote to memory of 2340 2800 cmd.exe 40 PID 2800 wrote to memory of 2340 2800 cmd.exe 40 PID 2800 wrote to memory of 2340 2800 cmd.exe 40 PID 2628 wrote to memory of 1944 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 41 PID 2628 wrote to memory of 1944 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 41 PID 2628 wrote to memory of 1944 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 41 PID 2628 wrote to memory of 1944 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 41 PID 1944 wrote to memory of 2020 1944 cmd.exe 43 PID 1944 wrote to memory of 2020 1944 cmd.exe 43 PID 1944 wrote to memory of 2020 1944 cmd.exe 43 PID 1944 wrote to memory of 2020 1944 cmd.exe 43 PID 2628 wrote to memory of 528 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 44 PID 2628 wrote to memory of 528 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 44 PID 2628 wrote to memory of 528 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 44 PID 2628 wrote to memory of 528 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 44 PID 528 wrote to memory of 2652 528 cmd.exe 46 PID 528 wrote to memory of 2652 528 cmd.exe 46 PID 528 wrote to memory of 2652 528 cmd.exe 46 PID 528 wrote to memory of 2652 528 cmd.exe 46 PID 2628 wrote to memory of 756 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 47 PID 2628 wrote to memory of 756 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 47 PID 2628 wrote to memory of 756 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 47 PID 2628 wrote to memory of 756 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 47 PID 756 wrote to memory of 780 756 cmd.exe 49 PID 756 wrote to memory of 780 756 cmd.exe 49 PID 756 wrote to memory of 780 756 cmd.exe 49 PID 756 wrote to memory of 780 756 cmd.exe 49 PID 2628 wrote to memory of 2780 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 50 PID 2628 wrote to memory of 2780 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 50 PID 2628 wrote to memory of 2780 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 50 PID 2628 wrote to memory of 2780 2628 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 50 PID 2780 wrote to memory of 1936 2780 cmd.exe 52 PID 2780 wrote to memory of 1936 2780 cmd.exe 52 PID 2780 wrote to memory of 1936 2780 cmd.exe 52 PID 2780 wrote to memory of 1936 2780 cmd.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe"C:\Users\Admin\AppData\Local\Temp\8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im mmc.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mmc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop WELM2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\sc.exesc stop WELM3⤵
- Launches sc.exe
PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete WELM2⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\sc.exesc delete WELM3⤵
- Launches sc.exe
PID:2340
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add policy name=netbc2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=netbc3⤵PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filterlist name=block2⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filterlist name=block3⤵PID:2652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filteraction name=block action=block2⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=block action=block3⤵PID:780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filter filterlist=block any srcmask=32 srcport=0 dstaddr=me dstport=445 protocol=tcp description=4452⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=block any srcmask=32 srcport=0 dstaddr=me dstport=445 protocol=tcp description=4453⤵PID:1936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add rule name=block policy=netbc filterlist=block filteraction=block2⤵PID:1724
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=block policy=netbc filterlist=block filteraction=block3⤵PID:1652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static set policy name=netbc assign=y2⤵PID:600
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=netbc assign=y3⤵PID:928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im msiexev.exe2⤵PID:1472
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msiexev.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Chrome"2⤵PID:2740
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Chrome"3⤵
- Modifies Windows Firewall
PID:2132
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Windriver"2⤵PID:1092
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Windriver"3⤵
- Modifies Windows Firewall
PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Chrome" dir=in program="%PROGRAMFILES%\Google\Chrome\Application\chrome.txt" action=allow2⤵PID:1244
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Chrome" dir=in program="C:\Program Files (x86)\Google\Chrome\Application\chrome.txt" action=allow3⤵
- Modifies Windows Firewall
PID:1072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Windriver" dir=in program="%PROGRAMFILES%\Hardware Driver Management\windriver.exe" action=allow2⤵PID:1088
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Windriver" dir=in program="C:\Program Files (x86)\Hardware Driver Management\windriver.exe" action=allow3⤵
- Modifies Windows Firewall
PID:592
-
-
-
C:\Windows\Fonts\wuauser.exeC:\Windows\Fonts\wuauser.exe --server1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵PID:1588
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵PID:2980
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵PID:2092
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵PID:2248
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-