Overview

overview

6

task1

 

6

task2

 

6

Analysis

  • max time kernel
    82s
  • max time network
    13s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    207804e5663f805c492bb78bf404a16d2db41416120026afb065cf991a48d906

  • Sample

    191025-f6ttaqn6da

  • SHA256

    207804e5663f805c492bb78bf404a16d2db41416120026afb065cf991a48d906

Score
N/A

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Drops file in system dir 64 IoCs
  • Drops desktop.ini 1 IoCs
  • Drops Office document 3 IoCs
    dropperexploitermaldoc
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Accessing to Master Boot Record (MBR) 1 TTPs 1 IoCs
    ransomwarebootkit
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\207804e5663f805c492bb78bf404a16d2db41416120026afb065cf991a48d906.exe
    "C:\Users\Admin\AppData\Local\Temp\207804e5663f805c492bb78bf404a16d2db41416120026afb065cf991a48d906.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Accessing to Master Boot Record (MBR)
    • Suspicious use of WriteProcessMemory
    PID:1312
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "1145494900162369655018148990691529387095-157741661026531389279276841363457141"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1400
  • C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C schtasks /create /tn "WindowsUpdatev1" /tr "C:\Users\Admin\AppData\Local\Temp\207804e5663f805c492bb78bf404a16d2db41416120026afb065cf991a48d906.exe" /sc onlogon
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1816
  • C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    1⤵
      PID:1456
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "9201826351812207032-1153075310-833623098-1725515642-36335303-1096284185994470168"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1112
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "-1108052224-1798237979-2115346884148494273-10359282406001780152589749911201466850"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1104
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "WindowsUpdatev1" /tr "C:\Users\Admin\AppData\Local\Temp\207804e5663f805c492bb78bf404a16d2db41416120026afb065cf991a48d906.exe" /sc onlogon
      1⤵
        PID:1984
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C del %systemroot% /F /S /Q
        1⤵
        • Drops file in system dir
        • Drops desktop.ini
        • Drops Office document
        PID:1920
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-239608306-1709560228-1094254200-1555416916-9402214781034493218-1244256140518640572"
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:844

      Network

      MITRE ATT&CK Additional techniques

      • T1067

      Replay Monitor

      Loading Replay Monitor...

      Downloads