46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
148s
max time network
158s
platform
windows7_x64
resource
win7v200722
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/9b8c48e6186718b7b290ceed9369a1a4.exe

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

1452 9b8c48e6186718b7b290ceed9369a1a4.tmp
Loads dropped DLL 3 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.exe9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

1412 9b8c48e6186718b7b290ceed9369a1a4.exe
1452 9b8c48e6186718b7b290ceed9369a1a4.tmp
1452 9b8c48e6186718b7b290ceed9369a1a4.tmp
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1748 schtasks.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

1452 9b8c48e6186718b7b290ceed9369a1a4.tmp
1452 9b8c48e6186718b7b290ceed9369a1a4.tmp
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

1452 9b8c48e6186718b7b290ceed9369a1a4.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

1452 9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
1452	9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
1412	9b8c48e6186718b7b290ceed9369a1a4.exe
1452	9b8c48e6186718b7b290ceed9369a1a4.tmp
1452	9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
1748	schtasks.exe

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1452	9b8c48e6186718b7b290ceed9369a1a4.tmp
1452	9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
1452	9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
1452	9b8c48e6186718b7b290ceed9369a1a4.tmp

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.exe9b8c48e6186718b7b290ceed9369a1a4.tmp

description	pid	process	target process
PID 1412 wrote to memory of 1452	1412	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 1412 wrote to memory of 1452	1412	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 1412 wrote to memory of 1452	1412	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 1412 wrote to memory of 1452	1412	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 1412 wrote to memory of 1452	1412	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 1412 wrote to memory of 1452	1412	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 1412 wrote to memory of 1452	1412	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 1452 wrote to memory of 1748	1452	9b8c48e6186718b7b290ceed9369a1a4.tmp	schtasks.exe
PID 1452 wrote to memory of 1748	1452	9b8c48e6186718b7b290ceed9369a1a4.tmp	schtasks.exe
PID 1452 wrote to memory of 1748	1452	9b8c48e6186718b7b290ceed9369a1a4.tmp	schtasks.exe
PID 1452 wrote to memory of 1748	1452	9b8c48e6186718b7b290ceed9369a1a4.tmp	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\foo\9b8c48e6186718b7b290ceed9369a1a4.exe
"C:\Users\Admin\AppData\Local\Temp\foo\9b8c48e6186718b7b290ceed9369a1a4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\is-Q2F4O.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q2F4O.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp" /SL5="$4015A,422409,257536,C:\Users\Admin\AppData\Local\Temp\foo\9b8c48e6186718b7b290ceed9369a1a4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN VKDJ /SC ONLOGON /TR "C:\ProgramData\VkontakteDJ\VkontakteDJ.exe /H" /F /DELAY 0001:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-Q2F4O.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp

MD5
1ed8c4d743c37c3cfae25e18b4c558eb

SHA1
5d7f687101ee48cb4812f592e8543a133c55777f

SHA256
e9950920fd95c6c16f163304ed234c01968a0801523baccf7fcff3d16025bd9e

SHA512
f0360ba649dedf5ec37f0a4dd7a296635b068840b0521117048d11628292527c95a3979421b89b3e0c391f2566bfe936bda5a38b3ff912ede9884e3e5024a190

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q2F4O.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp

MD5
1ed8c4d743c37c3cfae25e18b4c558eb

SHA1
5d7f687101ee48cb4812f592e8543a133c55777f

SHA256
e9950920fd95c6c16f163304ed234c01968a0801523baccf7fcff3d16025bd9e

SHA512
f0360ba649dedf5ec37f0a4dd7a296635b068840b0521117048d11628292527c95a3979421b89b3e0c391f2566bfe936bda5a38b3ff912ede9884e3e5024a190

Download Submit
\ProgramData\VkontakteDJ\unins000.exe

MD5
574ed4143ea6be839263c510084fe2cf

SHA1
c6cadd57b63755f017b512960d2d25d9fc5de3be

SHA256
35e0bb5886c08eb5e08fab7e22a6015e53a5fe3bfa00f0cc3913f057133fa15c

SHA512
8024158829d6ae19ff704ca57274abf392f75be4b145a2bd341c90a7074129d7cab158a5a0d4a535abbec6d2288ce87ea2215389b56878d5e5cdf12cc18b3ed4

Download Submit
\Users\Admin\AppData\Local\Temp\is-NU3HV.tmp\idp.dll

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
\Users\Admin\AppData\Local\Temp\is-Q2F4O.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp

MD5
1ed8c4d743c37c3cfae25e18b4c558eb

SHA1
5d7f687101ee48cb4812f592e8543a133c55777f

SHA256
e9950920fd95c6c16f163304ed234c01968a0801523baccf7fcff3d16025bd9e

SHA512
f0360ba649dedf5ec37f0a4dd7a296635b068840b0521117048d11628292527c95a3979421b89b3e0c391f2566bfe936bda5a38b3ff912ede9884e3e5024a190

Download Submit
memory/1452-1-0x0000000000000000-mapping.dmp

Download
memory/1520-4-0x000007FEF83B0000-0x000007FEF862A000-memory.dmp

Filesize
2.5MB

Download
memory/1748-7-0x0000000000000000-mapping.dmp

Download