Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 08:32
Static task
static1
Behavioral task
behavioral1
Sample
df6e1e72261d4741c7ab841b098ab497.exe
Resource
win7
Behavioral task
behavioral2
Sample
df6e1e72261d4741c7ab841b098ab497.exe
Resource
win10
General
-
Target
df6e1e72261d4741c7ab841b098ab497.exe
-
Size
151KB
-
MD5
df6e1e72261d4741c7ab841b098ab497
-
SHA1
f3f84f9a10315f95a73871a53452cf38ef32d9ac
-
SHA256
2026e97bd58d8848dbd55664417790d5ee804bc2fe86ad054cb6a304d2d39a6b
-
SHA512
70f9e5e2492bdb33ca85274455093d1bc8331b47e31dfdaec9cd47298d7834281c5f93b1b25379ee2aa51d68be320282e36f28ce6004fd9caae4905fc101078b
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
gennt.exesecinit.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\60c85a4d4ecb90012faa\\gennt.exe\"" gennt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\60c85a4d4ecb90012faa\\gennt.exe\"" secinit.exe -
Executes dropped EXE 1 IoCs
Processes:
gennt.exepid process 2116 gennt.exe -
Deletes itself 1 IoCs
Processes:
gennt.exepid process 2116 gennt.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
gennt.exesecinit.exedescription ioc process File opened (read-only) \??\G: gennt.exe File opened (read-only) \??\N: gennt.exe File opened (read-only) \??\W: gennt.exe File opened (read-only) \??\U: secinit.exe File opened (read-only) \??\B: secinit.exe File opened (read-only) \??\F: secinit.exe File opened (read-only) \??\P: secinit.exe File opened (read-only) \??\F: gennt.exe File opened (read-only) \??\P: gennt.exe File opened (read-only) \??\T: gennt.exe File opened (read-only) \??\X: gennt.exe File opened (read-only) \??\A: secinit.exe File opened (read-only) \??\Z: secinit.exe File opened (read-only) \??\Y: gennt.exe File opened (read-only) \??\X: secinit.exe File opened (read-only) \??\N: secinit.exe File opened (read-only) \??\V: secinit.exe File opened (read-only) \??\H: gennt.exe File opened (read-only) \??\I: gennt.exe File opened (read-only) \??\O: gennt.exe File opened (read-only) \??\Q: gennt.exe File opened (read-only) \??\U: gennt.exe File opened (read-only) \??\Y: secinit.exe File opened (read-only) \??\A: gennt.exe File opened (read-only) \??\R: gennt.exe File opened (read-only) \??\O: secinit.exe File opened (read-only) \??\Q: secinit.exe File opened (read-only) \??\W: secinit.exe File opened (read-only) \??\I: secinit.exe File opened (read-only) \??\L: secinit.exe File opened (read-only) \??\M: secinit.exe File opened (read-only) \??\K: gennt.exe File opened (read-only) \??\L: gennt.exe File opened (read-only) \??\M: gennt.exe File opened (read-only) \??\V: gennt.exe File opened (read-only) \??\Z: gennt.exe File opened (read-only) \??\S: secinit.exe File opened (read-only) \??\T: secinit.exe File opened (read-only) \??\B: gennt.exe File opened (read-only) \??\S: gennt.exe File opened (read-only) \??\H: secinit.exe File opened (read-only) \??\K: secinit.exe File opened (read-only) \??\R: secinit.exe File opened (read-only) \??\E: gennt.exe File opened (read-only) \??\J: gennt.exe File opened (read-only) \??\E: secinit.exe File opened (read-only) \??\G: secinit.exe File opened (read-only) \??\J: secinit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
gennt.exesecinit.exepid process 2116 gennt.exe 2116 gennt.exe 764 secinit.exe 764 secinit.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
df6e1e72261d4741c7ab841b098ab497.exegennt.exesecinit.exedescription pid process target process PID 2460 wrote to memory of 2116 2460 df6e1e72261d4741c7ab841b098ab497.exe gennt.exe PID 2460 wrote to memory of 2116 2460 df6e1e72261d4741c7ab841b098ab497.exe gennt.exe PID 2460 wrote to memory of 2116 2460 df6e1e72261d4741c7ab841b098ab497.exe gennt.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 764 2116 gennt.exe secinit.exe PID 2116 wrote to memory of 3720 2116 gennt.exe cmd.exe PID 2116 wrote to memory of 3720 2116 gennt.exe cmd.exe PID 2116 wrote to memory of 3720 2116 gennt.exe cmd.exe PID 764 wrote to memory of 484 764 secinit.exe cmd.exe PID 764 wrote to memory of 484 764 secinit.exe cmd.exe PID 764 wrote to memory of 484 764 secinit.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df6e1e72261d4741c7ab841b098ab497.exe"C:\Users\Admin\AppData\Local\Temp\df6e1e72261d4741c7ab841b098ab497.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\ProgramData\60c85a4d4ecb90012faa\gennt.exeC:\ProgramData\60c85a4d4ecb90012faa\gennt.exe "C:\Users\Admin\AppData\Local\Temp\df6e1e72261d4741c7ab841b098ab497.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\60c85a4d4ecb90012faa\gennt.exe3⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\60c85a4d4ecb90012faa}"4⤵PID:484
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\60c85a4d4ecb90012faa}"3⤵PID:3720
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
df6e1e72261d4741c7ab841b098ab497
SHA1f3f84f9a10315f95a73871a53452cf38ef32d9ac
SHA2562026e97bd58d8848dbd55664417790d5ee804bc2fe86ad054cb6a304d2d39a6b
SHA51270f9e5e2492bdb33ca85274455093d1bc8331b47e31dfdaec9cd47298d7834281c5f93b1b25379ee2aa51d68be320282e36f28ce6004fd9caae4905fc101078b
-
MD5
df6e1e72261d4741c7ab841b098ab497
SHA1f3f84f9a10315f95a73871a53452cf38ef32d9ac
SHA2562026e97bd58d8848dbd55664417790d5ee804bc2fe86ad054cb6a304d2d39a6b
SHA51270f9e5e2492bdb33ca85274455093d1bc8331b47e31dfdaec9cd47298d7834281c5f93b1b25379ee2aa51d68be320282e36f28ce6004fd9caae4905fc101078b