Analysis
- max time kernel
151s - max time network
147s - platform
windows7_x64 - resource
win7 - submitted
19/07/2020, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
satan_1.0.0.6.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
satan_1.0.0.6.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target satan_1.0.0.6.vir.exe
- Size 186KB
- Sample200719-qqms7j6ddx
- SHA256 84dd7afbfc63272eea2c55b6d079ef1897971516e3a7359aa932fec10ea6d4b6
- MD5 b15b72290de91e819900fa1a5b44d149
- SHA1 7182c6b1f970d882ef7e1c6c4608c43b80b6b381
- SHA512 1bc3225884abca71be1eb1cc1b16dc82fec8c657e0992957d93687e45e40e38aba701571f9f58ea7100b464ba2d64b0600548889c92826f17708eabc43822100
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7A26B6E5-3134-D57A-47BA-9CB0B8D11DB7} = "C:\\Users\\Admin\\AppData\\Roaming\\Yndofo\\rafi.exe" Dwm.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion satan_1.0.0.6.vir.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rafi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rafi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion satan_1.0.0.6.vir.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 1320 Explorer.EXE - Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Looks for VMWare Tools registry key 2 TTPs
- Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1424 wrote to memory of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 1488 wrote to memory of 912 1488 satan_1.0.0.6.vir.exe 25 PID 1488 wrote to memory of 912 1488 satan_1.0.0.6.vir.exe 25 PID 1488 wrote to memory of 912 1488 satan_1.0.0.6.vir.exe 25 PID 1488 wrote to memory of 912 1488 satan_1.0.0.6.vir.exe 25 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 912 wrote to memory of 740 912 rafi.exe 27 PID 1488 wrote to memory of 292 1488 satan_1.0.0.6.vir.exe 26 PID 1488 wrote to memory of 292 1488 satan_1.0.0.6.vir.exe 26 PID 1488 wrote to memory of 292 1488 satan_1.0.0.6.vir.exe 26 PID 1488 wrote to memory of 292 1488 satan_1.0.0.6.vir.exe 26 PID 740 wrote to memory of 1176 740 rafi.exe 18 PID 740 wrote to memory of 1176 740 rafi.exe 18 PID 740 wrote to memory of 1176 740 rafi.exe 18 PID 740 wrote to memory of 1256 740 rafi.exe 19 PID 740 wrote to memory of 1256 740 rafi.exe 19 PID 740 wrote to memory of 1256 740 rafi.exe 19 PID 740 wrote to memory of 1320 740 rafi.exe 20 PID 740 wrote to memory of 1320 740 rafi.exe 20 PID 740 wrote to memory of 1320 740 rafi.exe 20 PID 740 wrote to memory of 1100 740 rafi.exe 28 PID 740 wrote to memory of 1100 740 rafi.exe 28 PID 740 wrote to memory of 1100 740 rafi.exe 28 PID 1320 wrote to memory of 1804 1320 Explorer.EXE 29 PID 1320 wrote to memory of 1804 1320 Explorer.EXE 29 PID 1320 wrote to memory of 1804 1320 Explorer.EXE 29 PID 1256 wrote to memory of 740 1256 Dwm.exe 27 PID 1256 wrote to memory of 740 1256 Dwm.exe 27 PID 1256 wrote to memory of 740 1256 Dwm.exe 27 PID 1256 wrote to memory of 1236 1256 Dwm.exe 31 PID 1256 wrote to memory of 1236 1256 Dwm.exe 31 PID 1256 wrote to memory of 1236 1256 Dwm.exe 31 PID 1256 wrote to memory of 1936 1256 Dwm.exe 34 PID 1256 wrote to memory of 1936 1256 Dwm.exe 34 PID 1256 wrote to memory of 1936 1256 Dwm.exe 34 - Executes dropped EXE 2 IoCs
pid Process 912 rafi.exe 740 rafi.exe - Deletes itself 1 IoCs
pid Process 292 cmd.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
pid Process 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1176 taskhost.exe 1176 taskhost.exe 1176 taskhost.exe 1176 taskhost.exe 740 rafi.exe 740 rafi.exe 740 rafi.exe 1236 DllHost.exe 1236 DllHost.exe 1236 DllHost.exe 1936 DllHost.exe 1936 DllHost.exe 1936 DllHost.exe 740 rafi.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE - Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1804 vssadmin.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious behavior: EnumeratesProcesses 96 IoCs
pid Process 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 1424 satan_1.0.0.6.vir.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 912 rafi.exe 740 rafi.exe 740 rafi.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe 1256 Dwm.exe - Loads dropped DLL 2 IoCs
pid Process 1488 satan_1.0.0.6.vir.exe 1488 satan_1.0.0.6.vir.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1644 vssvc.exe Token: SeRestorePrivilege 1644 vssvc.exe Token: SeAuditPrivilege 1644 vssvc.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1424 set thread context of 1488 1424 satan_1.0.0.6.vir.exe 24 PID 912 set thread context of 740 912 rafi.exe 27
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1176
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1256
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\satan_1.0.0.6.vir.exe"C:\Users\Admin\AppData\Local\Temp\satan_1.0.0.6.vir.exe"2⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\satan_1.0.0.6.vir.exe"C:\Users\Admin\AppData\Local\Temp\satan_1.0.0.6.vir.exe"3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Roaming\Yndofo\rafi.exe"C:\Users\Admin\AppData\Roaming\Yndofo\rafi.exe"4⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:912 -
C:\Users\Admin\AppData\Roaming\Yndofo\rafi.exe"C:\Users\Admin\AppData\Roaming\Yndofo\rafi.exe"5⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:740
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_a32aed68.bat"4⤵
- Deletes itself
PID:292
-
-
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1804
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1699844881-738193331748808369717385504691404484-20130395-1945258830-102497171"1⤵PID:1100
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1236
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1644
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1936