Overview
overview
10Static
static
3malware-sa...er.zip
windows7-x64
1malware-sa...er.zip
windows10-2004-x64
18200755cbe...33.exe
windows7-x64
88200755cbe...33.exe
windows10-2004-x64
829c7e87350...5b.exe
windows7-x64
129c7e87350...5b.exe
windows10-2004-x64
149cccd30a5...90.exe
windows7-x64
149cccd30a5...90.exe
windows10-2004-x64
9b17911ddea...82.exe
windows7-x64
1b17911ddea...82.exe
windows10-2004-x64
102ca4397da...51.exe
windows7-x64
102ca4397da...51.exe
windows10-2004-x64
1022aeb126d...74.exe
windows7-x64
9022aeb126d...74.exe
windows10-2004-x64
9smb-7teux2sm.exe
windows7-x64
9smb-7teux2sm.exe
windows10-2004-x64
9smb-onil0o36.exe
windows7-x64
9smb-onil0o36.exe
windows10-2004-x64
9malware-sa...ab.exe
windows7-x64
10malware-sa...ab.exe
windows10-2004-x64
10malware-sa...1).exe
windows7-x64
6malware-sa...1).exe
windows10-2004-x64
6malware-sa...n.xlsx
windows7-x64
1malware-sa...n.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
599s -
max time network
595s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08-03-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
malware-samples-master.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
malware-samples-master.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
smb-7teux2sm.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
smb-7teux2sm.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
smb-onil0o36.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
smb-onil0o36.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win10v2004-20240226-en
General
-
Target
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
-
Size
1.4MB
-
MD5
f2e1d236c5d2c009e1749fc6479a9ede
-
SHA1
262c22ffd66c33da641558f3da23f7584881a782
-
SHA256
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233
-
SHA512
3b3174ac17e377028accf1ebfd6bd6ae97fc99c4e7814f8ad0fe707dc77d757f26d667333efb495a9b9768d49672737233c88d7a50b4dc81ad170f068ad95cc1
-
SSDEEP
24576:6EpKGrwKydag/jU7IZK8LNmf2+r+eauoUWg6ye2tX9t5WR4MJh:6nGrwKtg7U7I88Zi2/xxyeAt06a
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 4 IoCs
pid Process 1160 netsh.exe 2908 netsh.exe 1540 netsh.exe 2236 netsh.exe -
Stops running service(s) 3 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\id.txt wuauser.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2708 sc.exe 2424 sc.exe -
Kills process with taskkill 7 IoCs
pid Process 912 taskkill.exe 556 taskkill.exe 2176 taskkill.exe 2632 taskkill.exe 2936 taskkill.exe 2972 taskkill.exe 1452 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe 2780 wuauser.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2176 taskkill.exe Token: SeDebugPrivilege 2632 taskkill.exe Token: SeDebugPrivilege 2936 taskkill.exe Token: SeDebugPrivilege 2972 taskkill.exe Token: SeDebugPrivilege 1452 taskkill.exe Token: SeDebugPrivilege 912 taskkill.exe Token: SeDebugPrivilege 556 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1392 wrote to memory of 2144 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 28 PID 1392 wrote to memory of 2144 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 28 PID 1392 wrote to memory of 2144 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 28 PID 1392 wrote to memory of 2144 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 28 PID 2144 wrote to memory of 2176 2144 cmd.exe 30 PID 2144 wrote to memory of 2176 2144 cmd.exe 30 PID 2144 wrote to memory of 2176 2144 cmd.exe 30 PID 2144 wrote to memory of 2176 2144 cmd.exe 30 PID 1392 wrote to memory of 2560 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 32 PID 1392 wrote to memory of 2560 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 32 PID 1392 wrote to memory of 2560 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 32 PID 1392 wrote to memory of 2560 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 32 PID 2560 wrote to memory of 2632 2560 cmd.exe 34 PID 2560 wrote to memory of 2632 2560 cmd.exe 34 PID 2560 wrote to memory of 2632 2560 cmd.exe 34 PID 2560 wrote to memory of 2632 2560 cmd.exe 34 PID 1392 wrote to memory of 2976 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 35 PID 1392 wrote to memory of 2976 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 35 PID 1392 wrote to memory of 2976 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 35 PID 1392 wrote to memory of 2976 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 35 PID 2976 wrote to memory of 2708 2976 cmd.exe 37 PID 2976 wrote to memory of 2708 2976 cmd.exe 37 PID 2976 wrote to memory of 2708 2976 cmd.exe 37 PID 2976 wrote to memory of 2708 2976 cmd.exe 37 PID 1392 wrote to memory of 2704 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 38 PID 1392 wrote to memory of 2704 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 38 PID 1392 wrote to memory of 2704 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 38 PID 1392 wrote to memory of 2704 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 38 PID 2704 wrote to memory of 2424 2704 cmd.exe 40 PID 2704 wrote to memory of 2424 2704 cmd.exe 40 PID 2704 wrote to memory of 2424 2704 cmd.exe 40 PID 2704 wrote to memory of 2424 2704 cmd.exe 40 PID 1392 wrote to memory of 2436 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 41 PID 1392 wrote to memory of 2436 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 41 PID 1392 wrote to memory of 2436 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 41 PID 1392 wrote to memory of 2436 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 41 PID 2436 wrote to memory of 2496 2436 cmd.exe 43 PID 2436 wrote to memory of 2496 2436 cmd.exe 43 PID 2436 wrote to memory of 2496 2436 cmd.exe 43 PID 2436 wrote to memory of 2496 2436 cmd.exe 43 PID 1392 wrote to memory of 2968 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 44 PID 1392 wrote to memory of 2968 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 44 PID 1392 wrote to memory of 2968 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 44 PID 1392 wrote to memory of 2968 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 44 PID 2968 wrote to memory of 2080 2968 cmd.exe 46 PID 2968 wrote to memory of 2080 2968 cmd.exe 46 PID 2968 wrote to memory of 2080 2968 cmd.exe 46 PID 2968 wrote to memory of 2080 2968 cmd.exe 46 PID 1392 wrote to memory of 2304 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 47 PID 1392 wrote to memory of 2304 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 47 PID 1392 wrote to memory of 2304 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 47 PID 1392 wrote to memory of 2304 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 47 PID 2304 wrote to memory of 2760 2304 cmd.exe 49 PID 2304 wrote to memory of 2760 2304 cmd.exe 49 PID 2304 wrote to memory of 2760 2304 cmd.exe 49 PID 2304 wrote to memory of 2760 2304 cmd.exe 49 PID 1392 wrote to memory of 1996 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 50 PID 1392 wrote to memory of 1996 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 50 PID 1392 wrote to memory of 1996 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 50 PID 1392 wrote to memory of 1996 1392 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 50 PID 1996 wrote to memory of 2308 1996 cmd.exe 52 PID 1996 wrote to memory of 2308 1996 cmd.exe 52 PID 1996 wrote to memory of 2308 1996 cmd.exe 52 PID 1996 wrote to memory of 2308 1996 cmd.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe"C:\Users\Admin\AppData\Local\Temp\8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im mmc.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mmc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop WELM2⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\sc.exesc stop WELM3⤵
- Launches sc.exe
PID:2708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete WELM2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\sc.exesc delete WELM3⤵
- Launches sc.exe
PID:2424
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add policy name=netbc2⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=netbc3⤵PID:2496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filterlist name=block2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filterlist name=block3⤵PID:2080
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filteraction name=block action=block2⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=block action=block3⤵PID:2760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filter filterlist=block any srcmask=32 srcport=0 dstaddr=me dstport=445 protocol=tcp description=4452⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=block any srcmask=32 srcport=0 dstaddr=me dstport=445 protocol=tcp description=4453⤵PID:2308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add rule name=block policy=netbc filterlist=block filteraction=block2⤵PID:2488
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=block policy=netbc filterlist=block filteraction=block3⤵PID:1656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static set policy name=netbc assign=y2⤵PID:2480
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=netbc assign=y3⤵PID:1080
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im msiexev.exe2⤵PID:496
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msiexev.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Chrome"2⤵PID:1616
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Chrome"3⤵
- Modifies Windows Firewall
PID:1160
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Windriver"2⤵PID:452
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Windriver"3⤵
- Modifies Windows Firewall
PID:2908
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Chrome" dir=in program="%PROGRAMFILES%\Google\Chrome\Application\chrome.txt" action=allow2⤵PID:1468
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Chrome" dir=in program="C:\Program Files (x86)\Google\Chrome\Application\chrome.txt" action=allow3⤵
- Modifies Windows Firewall
PID:1540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Windriver" dir=in program="%PROGRAMFILES%\Hardware Driver Management\windriver.exe" action=allow2⤵PID:1608
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Windriver" dir=in program="C:\Program Files (x86)\Hardware Driver Management\windriver.exe" action=allow3⤵
- Modifies Windows Firewall
PID:2236
-
-
-
C:\Windows\Fonts\wuauser.exeC:\Windows\Fonts\wuauser.exe --server1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵PID:936
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵PID:2252
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵PID:2240
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵PID:1240
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:912
-
-