Overview

overview

9

task1

 

9

task2

 

9

Resubmissions

30-10-2019 18:36

191030-4jjvvmbgys 0

30-10-2019 17:06

191030-cdxr5hrvmn 0

Analysis

  • max time kernel
    111s
  • max time network
    120s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iis_agent32.exe

  • Sample

    191030-4jjvvmbgys

  • SHA256

    9730e03ca9d052875895b4ad7ba7914f69009fd5fb58d324ee35d3e45f90d768

Score
N/A

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Uses Volume Shadow Copy Service COM API 19 IoCs
    ransomware
  • Modifies Boot Configuration Data 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes itself 1 IoCs
  • Drops Office document 12 IoCs
    dropperexploitermaldoc
  • Timeout.exe delays execution 1 IoCs
    evasion
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Deletes shadow copies 2 TTPs 2 IoCs
    ransomware
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Drops file in system dir 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\iis_agent32.exe
    "C:\Users\Admin\AppData\Local\Temp\iis_agent32.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Drops Office document
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in system dir
    PID:1380
  • C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /Quiet
    1⤵
      PID:1320
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "-1908392402-1638536916-27801542-1072352984-484855387-5478566241539925594-1754304342"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1748
    • C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /Quiet
      1⤵
      • Uses Volume Shadow Copy Service COM API
      • Deletes shadow copies
      PID:1640
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Uses Volume Shadow Copy Service COM API
      PID:1140
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k swprv
      1⤵
        PID:1084
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C WMIC.exe shadowcopy delete
        1⤵
          PID:1940
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "11090750511362864905-690821326966661351-476877284-1464817633-601390788-630546323"
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:1944
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC.exe shadowcopy delete
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          • Deletes shadow copies
          PID:1924
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C Bcdedit.exe /set {default} recoveryenabled no
          1⤵
            PID:604
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "1357304515-49625428213239389931465246131-418946311504728357825126170-1064745522"
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:284
          • C:\Windows\system32\bcdedit.exe
            Bcdedit.exe /set {default} recoveryenabled no
            1⤵
            • Modifies Boot Configuration Data
            PID:756
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
            1⤵
              PID:204
            • C:\Windows\system32\conhost.exe
              \??\C:\Windows\system32\conhost.exe "5025345331680141083-19158288391376973526-4805526921722215271-21176376001281869524"
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:212
            • C:\Windows\system32\bcdedit.exe
              Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
              1⤵
              • Modifies Boot Configuration Data
              PID:228
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl Application
              1⤵
                PID:236
              • C:\Windows\system32\conhost.exe
                \??\C:\Windows\system32\conhost.exe "1059176373-20092165114112753089567963-1675922385-9916231351461502116241192927"
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:1972
              • C:\Windows\system32\wevtutil.exe
                wevtutil.exe cl Application
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                • Clears Windows event logs
                PID:1848
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl Security
                1⤵
                  PID:1200
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "-196488826112545111336593321462171308451233641194915805797-20827898011394804628"
                  1⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1872
                • C:\Windows\system32\wevtutil.exe
                  wevtutil.exe cl Security
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Clears Windows event logs
                  PID:796
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl System
                  1⤵
                    PID:1864
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "1235315038-61189685-90689838418030054421422413928-47328221119633480651789024587"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1716
                  • C:\Windows\system32\wevtutil.exe
                    wevtutil.exe cl System
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Clears Windows event logs
                    PID:1940
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C timeout 5 && Del /Q /F C:\Users\Admin\AppData\Local\Temp\iis_agent32.exe
                    1⤵
                    • Deletes itself
                    PID:1320
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "-804305386937037444-1220658503726070867-159655832-4024920791912928371-1174468790"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1872
                  • C:\Windows\system32\timeout.exe
                    timeout 5
                    1⤵
                    • Timeout.exe delays execution
                    PID:1940

                  Network

                  MITRE ATT&CK Enterprise v15

                  MITRE ATT&CK Additional techniques

                  • T1107

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads