Overview

overview

9

task1

 

7

task2

 

9

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • resource
    win10v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    222b2b80b21db2584d9cb51082f7eadf0bbf04bb2a555ef850391d62dd68d5d9

  • Sample

    191025-w35pvd2lbx

  • SHA256

    222b2b80b21db2584d9cb51082f7eadf0bbf04bb2a555ef850391d62dd68d5d9

Score
N/A

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Modifies registry class 1 TTPs 64 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Drops file in system dir 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Drops Office document 23 IoCs
    dropperexploitermaldoc
  • Modifies control panel 2 IoCs
    evasion
  • Checks processor information in registry (likely anti-VM) 2 TTPs 2 IoCs
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Modifies service 2 TTPs 1 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\222b2b80b21db2584d9cb51082f7eadf0bbf04bb2a555ef850391d62dd68d5d9.exe
    "C:\Users\Admin\AppData\Local\Temp\222b2b80b21db2584d9cb51082f7eadf0bbf04bb2a555ef850391d62dd68d5d9.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Sets desktop wallpaper using registry
    • Suspicious use of WriteProcessMemory
    • Drops Office document
    • Modifies control panel
    PID:4920
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5064
  • C:\Windows\System32\SLUI.exe
    "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
    1⤵
      PID:5092
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3068
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
      1⤵
      • Deletes shadow copies
      PID:4028
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k swprv
      1⤵
        PID:4520
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Modifies registry class
        • Drops file in system dir
        • Suspicious use of SetWindowsHookEx
        PID:3696
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
          PID:4228
        • C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
          "C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe" -ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca
          1⤵
          • Enumerates system info in registry
          • Checks processor information in registry (likely anti-VM)
          • Suspicious use of SetWindowsHookEx
          PID:3452
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetWindowsHookEx
          • Suspicious behavior: MapViewOfSection
          PID:3344
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:772
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\222b2b80b21db2584d9cb51082f7eadf0bbf04bb2a555ef850391d62dd68d5d9.exe"
          1⤵
            PID:672
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1180
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s BITS
            1⤵
            • Modifies service
            PID:1940
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
            1⤵
              PID:2372
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
              1⤵
              • Checks system information in the registry (likely anti-VM)
              PID:3836
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k unistacksvcgroup
              1⤵
                PID:4608
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
                1⤵
                • Windows security modification
                PID:4900
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                  PID:2968

                Network

                MITRE ATT&CK Enterprise v15

                MITRE ATT&CK Additional techniques

                • T1089
                • T1107
                • T1031

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/1940-1-0x0000020AB2F60000-0x0000020AB2F70000-memory.dmp

                  Filesize

                  64KB

                  Download