Overview

overview

9

task1

 

9

task2

 

9

Resubmissions

30-10-2019 18:36

191030-4jjvvmbgys 0

30-10-2019 17:06

191030-cdxr5hrvmn 0

Analysis

  • max time kernel
    113s
  • max time network
    121s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iis_agent32.exe

  • Sample

    191030-cdxr5hrvmn

  • SHA256

    9730e03ca9d052875895b4ad7ba7914f69009fd5fb58d324ee35d3e45f90d768

Score
N/A

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Drops file in system dir 64 IoCs
  • Drops Office document 12 IoCs
    dropperexploitermaldoc
  • Timeout.exe delays execution 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy Service COM API 19 IoCs
    ransomware
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Deletes itself 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Deletes shadow copies 2 TTPs 2 IoCs
    ransomware
  • Modifies Boot Configuration Data 1 TTPs 2 IoCs
    ransomwareevasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\iis_agent32.exe
    "C:\Users\Admin\AppData\Local\Temp\iis_agent32.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in system dir
    • Drops Office document
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:596
  • C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /Quiet
    1⤵
      PID:1968
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "152746991617797927937621948-813802796-9066468752032384393-1647537477-35610873"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1992
    • C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /Quiet
      1⤵
      • Uses Volume Shadow Copy Service COM API
      • Deletes shadow copies
      PID:1432
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Uses Volume Shadow Copy Service COM API
      PID:1468
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k swprv
      1⤵
        PID:1496
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C WMIC.exe shadowcopy delete
        1⤵
          PID:2044
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "-16667158601883710953-602057339277282595-129848417-1485555278-2141958844-1525539551"
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:2028
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC.exe shadowcopy delete
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          • Deletes shadow copies
          PID:2020
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C Bcdedit.exe /set {default} recoveryenabled no
          1⤵
            PID:1116
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "1138862790176837176690911350724443424918102909263872890522038853367-812709330"
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:208
          • C:\Windows\system32\bcdedit.exe
            Bcdedit.exe /set {default} recoveryenabled no
            1⤵
            • Modifies Boot Configuration Data
            PID:224
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
            1⤵
              PID:232
            • C:\Windows\system32\conhost.exe
              \??\C:\Windows\system32\conhost.exe "-978576110-481346106-1102864460-15362863881583620561-1618847635-954596868150963763"
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:108
            • C:\Windows\system32\bcdedit.exe
              Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
              1⤵
              • Modifies Boot Configuration Data
              PID:1408
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl Application
              1⤵
                PID:1432
              • C:\Windows\system32\conhost.exe
                \??\C:\Windows\system32\conhost.exe "2140517884-16849149-12054554319905670011927981335-164935125-2070858680220810265"
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:1964
              • C:\Windows\system32\wevtutil.exe
                wevtutil.exe cl Application
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                • Clears Windows event logs
                PID:2032
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl Security
                1⤵
                  PID:544
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "-1473418552788637786-1774555455-1316794554-165781596516314669141730327226-944160666"
                  1⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1156
                • C:\Windows\system32\wevtutil.exe
                  wevtutil.exe cl Security
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Clears Windows event logs
                  PID:1284
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C wevtutil.exe cl System
                  1⤵
                    PID:2040
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "1335176544-1294711942-1322247224599937889-741851558-8580353821051353222036059672"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:212
                  • C:\Windows\system32\wevtutil.exe
                    wevtutil.exe cl System
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Clears Windows event logs
                    PID:204
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C timeout 5 && Del /Q /F C:\Users\Admin\AppData\Local\Temp\iis_agent32.exe
                    1⤵
                    • Deletes itself
                    PID:1116
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "-334251469413210185499720249345694871-11205306123477132641153833510-1961310043"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:212
                  • C:\Windows\system32\timeout.exe
                    timeout 5
                    1⤵
                    • Timeout.exe delays execution
                    PID:1176

                  Network

                  MITRE ATT&CK Enterprise v15

                  MITRE ATT&CK Additional techniques

                  • T1107

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads