Overview

overview

9

task1

 

9

task2

 

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4

  • Sample

    191025-dn8qy4kq5x

  • SHA256

    e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4

Score
N/A

Malware Config

Signatures

  • Drops Office document 20 IoCs
    dropperexploitermaldoc
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Modifies control panel 2 IoCs
    evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Deletes itself 1 IoCs
  • Drops file in system dir 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 13 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe
    "C:\Users\Admin\AppData\Local\Temp\e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe"
    1⤵
    • Drops Office document
    • Suspicious use of WriteProcessMemory
    • Modifies control panel
    • Sets desktop wallpaper using registry
    PID:2024
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1480
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {59FFE777-90C9-49B9-B7C1-E1679627E154} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1560
  • C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
    1⤵
    • Deletes shadow copies
    PID:1456
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "1138213463-1895528116-1008379782-1151265992-62393745-14787800111541998338-1334743294"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:848
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k swprv
    1⤵
      PID:2028
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ykcol.htm
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      PID:1572
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Drops file in system dir
      • Suspicious use of FindShellTrayWindow
      PID:1668
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe"
      1⤵
      • Deletes itself
      PID:1952
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "170567490699066284820195978591905946548-1324181297-6827939461883015892416655494"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1664
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:275457 /prefetch:2
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Modifies Internet Explorer settings
      PID:1496

    Network

    MITRE ATT&CK Enterprise v16

    MITRE ATT&CK Additional techniques

    • T1107

    Replay Monitor

    Loading Replay Monitor...

    Downloads