Analysis
- max time kernel
158s - max time network
178s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system - submitted
24/03/2024, 01:28
Behavioral task
behavioral1
Sample
2f86e736a415a672a4bbb780f60d133e.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f86e736a415a672a4bbb780f60d133e.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2f86e736a415a672a4bbb780f60d133e.exe
- Size 73KB
- Sample240324-bvwvfsff68
- SHA256 cf7a2a2c2d65f4f1e93a3744d374ea2726022dfc94c572483e15f8a4a7637309
- MD5 2f86e736a415a672a4bbb780f60d133e
- SHA1 bec7a686d793bd43ba38013ede4325a7e45987de
- SHA512 52fe41baab4ff76e7502081e9771ba1c0db04ba88d6dbb34c223c1e3c78879953ffc1938429f4bac8810298930be0c513d2930384be57826ca27c5b85d115f53
- SSDEEP 1536:655u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:gMSjOnrmBTMqqDL2/mr3IdE8we0Avu5h
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\amhuhmjfinw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2f86e736a415a672a4bbb780f60d133e.exe" 2f86e736a415a672a4bbb780f60d133e.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\V: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\W: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\X: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\G: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\L: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\U: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\Y: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\I: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\K: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\H: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\J: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\M: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\N: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\P: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\T: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\B: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\E: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\Q: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\S: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\Z: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\A: 2f86e736a415a672a4bbb780f60d133e.exe File opened (read-only) \??\O: 2f86e736a415a672a4bbb780f60d133e.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2f86e736a415a672a4bbb780f60d133e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2f86e736a415a672a4bbb780f60d133e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2f86e736a415a672a4bbb780f60d133e.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 384 2f86e736a415a672a4bbb780f60d133e.exe 384 2f86e736a415a672a4bbb780f60d133e.exe 384 2f86e736a415a672a4bbb780f60d133e.exe 384 2f86e736a415a672a4bbb780f60d133e.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 384 wrote to memory of 788 384 2f86e736a415a672a4bbb780f60d133e.exe 96 PID 384 wrote to memory of 788 384 2f86e736a415a672a4bbb780f60d133e.exe 96 PID 384 wrote to memory of 788 384 2f86e736a415a672a4bbb780f60d133e.exe 96 PID 384 wrote to memory of 3176 384 2f86e736a415a672a4bbb780f60d133e.exe 100 PID 384 wrote to memory of 3176 384 2f86e736a415a672a4bbb780f60d133e.exe 100 PID 384 wrote to memory of 3176 384 2f86e736a415a672a4bbb780f60d133e.exe 100 PID 384 wrote to memory of 2652 384 2f86e736a415a672a4bbb780f60d133e.exe 104 PID 384 wrote to memory of 2652 384 2f86e736a415a672a4bbb780f60d133e.exe 104 PID 384 wrote to memory of 2652 384 2f86e736a415a672a4bbb780f60d133e.exe 104 PID 384 wrote to memory of 4012 384 2f86e736a415a672a4bbb780f60d133e.exe 106 PID 384 wrote to memory of 4012 384 2f86e736a415a672a4bbb780f60d133e.exe 106 PID 384 wrote to memory of 4012 384 2f86e736a415a672a4bbb780f60d133e.exe 106 PID 384 wrote to memory of 2664 384 2f86e736a415a672a4bbb780f60d133e.exe 111 PID 384 wrote to memory of 2664 384 2f86e736a415a672a4bbb780f60d133e.exe 111 PID 384 wrote to memory of 2664 384 2f86e736a415a672a4bbb780f60d133e.exe 111 PID 384 wrote to memory of 1388 384 2f86e736a415a672a4bbb780f60d133e.exe 113 PID 384 wrote to memory of 1388 384 2f86e736a415a672a4bbb780f60d133e.exe 113 PID 384 wrote to memory of 1388 384 2f86e736a415a672a4bbb780f60d133e.exe 113 PID 384 wrote to memory of 1744 384 2f86e736a415a672a4bbb780f60d133e.exe 115 PID 384 wrote to memory of 1744 384 2f86e736a415a672a4bbb780f60d133e.exe 115 PID 384 wrote to memory of 1744 384 2f86e736a415a672a4bbb780f60d133e.exe 115 PID 384 wrote to memory of 1880 384 2f86e736a415a672a4bbb780f60d133e.exe 117 PID 384 wrote to memory of 1880 384 2f86e736a415a672a4bbb780f60d133e.exe 117 PID 384 wrote to memory of 1880 384 2f86e736a415a672a4bbb780f60d133e.exe 117 PID 384 wrote to memory of 4704 384 2f86e736a415a672a4bbb780f60d133e.exe 119 PID 384 wrote to memory of 4704 384 2f86e736a415a672a4bbb780f60d133e.exe 119 PID 384 wrote to memory of 4704 384 2f86e736a415a672a4bbb780f60d133e.exe 119 PID 384 wrote to memory of 1276 384 2f86e736a415a672a4bbb780f60d133e.exe 121 PID 384 wrote to memory of 1276 384 2f86e736a415a672a4bbb780f60d133e.exe 121 PID 384 wrote to memory of 1276 384 2f86e736a415a672a4bbb780f60d133e.exe 121 PID 384 wrote to memory of 556 384 2f86e736a415a672a4bbb780f60d133e.exe 123 PID 384 wrote to memory of 556 384 2f86e736a415a672a4bbb780f60d133e.exe 123 PID 384 wrote to memory of 556 384 2f86e736a415a672a4bbb780f60d133e.exe 123 PID 384 wrote to memory of 4340 384 2f86e736a415a672a4bbb780f60d133e.exe 125 PID 384 wrote to memory of 4340 384 2f86e736a415a672a4bbb780f60d133e.exe 125 PID 384 wrote to memory of 4340 384 2f86e736a415a672a4bbb780f60d133e.exe 125 PID 384 wrote to memory of 4600 384 2f86e736a415a672a4bbb780f60d133e.exe 127 PID 384 wrote to memory of 4600 384 2f86e736a415a672a4bbb780f60d133e.exe 127 PID 384 wrote to memory of 4600 384 2f86e736a415a672a4bbb780f60d133e.exe 127 PID 384 wrote to memory of 1964 384 2f86e736a415a672a4bbb780f60d133e.exe 129 PID 384 wrote to memory of 1964 384 2f86e736a415a672a4bbb780f60d133e.exe 129 PID 384 wrote to memory of 1964 384 2f86e736a415a672a4bbb780f60d133e.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f86e736a415a672a4bbb780f60d133e.exe"C:\Users\Admin\AppData\Local\Temp\2f86e736a415a672a4bbb780f60d133e.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:788
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:3176
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2652
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4012
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2664
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1388
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1744
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:1880
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4704
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1276
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:556
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4340
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4600
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:81⤵PID:3872