Resubmissions

30-10-2019 18:36

191030-4jjvvmbgys 0

30-10-2019 17:06

191030-cdxr5hrvmn 0

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • resource
    win10v191014

General

  • Target

    iis_agent32.exe

  • Sample

    191030-4jjvvmbgys

  • SHA256

    9730e03ca9d052875895b4ad7ba7914f69009fd5fb58d324ee35d3e45f90d768

Score
N/A

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Deletes shadow copies 2 TTPs 2 IoCs
  • Uses Volume Shadow Copy Service COM API 14 IoCs
  • Modifies Boot Configuration Data 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Drops file in system dir 64 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Clears Windows event logs 1 TTPs 3 IoCs
  • Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\iis_agent32.exe
    "C:\Users\Admin\AppData\Local\Temp\iis_agent32.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in system dir
    PID:4868
  • C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /Quiet
    1⤵
      PID:5044
    • C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /Quiet
      1⤵
      • Deletes shadow copies
      • Uses Volume Shadow Copy Service COM API
      PID:5084
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Uses Volume Shadow Copy Service COM API
      PID:5112
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k swprv
      1⤵
        PID:2028
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C WMIC.exe shadowcopy delete
        1⤵
          PID:360
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC.exe shadowcopy delete
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          • Deletes shadow copies
          PID:4280
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C Bcdedit.exe /set {default} recoveryenabled no
          1⤵
            PID:3980
          • C:\Windows\system32\bcdedit.exe
            Bcdedit.exe /set {default} recoveryenabled no
            1⤵
            • Modifies Boot Configuration Data
            PID:4444
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
            1⤵
              PID:4472
            • C:\Windows\system32\bcdedit.exe
              Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
              1⤵
              • Modifies Boot Configuration Data
              PID:3664
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl Application
              1⤵
                PID:3636
              • C:\Windows\system32\wevtutil.exe
                wevtutil.exe cl Application
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                • Clears Windows event logs
                PID:4600
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl Security
                1⤵
                  PID:4548
                • C:\Windows\system32\wevtutil.exe
                  wevtutil.exe cl Security
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Clears Windows event logs
                  PID:1624
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl System
                  1⤵
                    PID:4656
                  • C:\Windows\system32\SppExtComObj.exe
                    C:\Windows\system32\SppExtComObj.exe -Embedding
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4624
                  • C:\Windows\system32\wevtutil.exe
                    wevtutil.exe cl System
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Clears Windows event logs
                    PID:4688
                  • C:\Windows\System32\SLUI.exe
                    "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
                    1⤵
                      PID:4308
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                      1⤵
                        PID:4024
                      • \??\c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                        1⤵
                          PID:4832
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
                          1⤵
                          • Checks system information in the registry (likely anti-VM)
                          PID:4968
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
                          1⤵
                          • Windows security modification
                          PID:992
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k unistacksvcgroup
                          1⤵
                            PID:4056

                          Network

                          MITRE ATT&CK Enterprise v15

                          MITRE ATT&CK Additional techniques

                          • T1107
                          • T1089

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads