46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
67s
max time network
148s
platform
windows10_x64
resource
win10
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/9b8c48e6186718b7b290ceed9369a1a4.exe

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

3836 9b8c48e6186718b7b290ceed9369a1a4.tmp
Loads dropped DLL 1 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

3836 9b8c48e6186718b7b290ceed9369a1a4.tmp
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3936 schtasks.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

3836 9b8c48e6186718b7b290ceed9369a1a4.tmp
3836 9b8c48e6186718b7b290ceed9369a1a4.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.tmp

pid process

3836 9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
3836	9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
3836	9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
3936	schtasks.exe

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
3836	9b8c48e6186718b7b290ceed9369a1a4.tmp
3836	9b8c48e6186718b7b290ceed9369a1a4.tmp

pid	process
3836	9b8c48e6186718b7b290ceed9369a1a4.tmp

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9b8c48e6186718b7b290ceed9369a1a4.exe9b8c48e6186718b7b290ceed9369a1a4.tmp

description	pid	process	target process
PID 3884 wrote to memory of 3836	3884	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 3884 wrote to memory of 3836	3884	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 3884 wrote to memory of 3836	3884	9b8c48e6186718b7b290ceed9369a1a4.exe	9b8c48e6186718b7b290ceed9369a1a4.tmp
PID 3836 wrote to memory of 3936	3836	9b8c48e6186718b7b290ceed9369a1a4.tmp	schtasks.exe
PID 3836 wrote to memory of 3936	3836	9b8c48e6186718b7b290ceed9369a1a4.tmp	schtasks.exe
PID 3836 wrote to memory of 3936	3836	9b8c48e6186718b7b290ceed9369a1a4.tmp	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\foo\9b8c48e6186718b7b290ceed9369a1a4.exe
"C:\Users\Admin\AppData\Local\Temp\foo\9b8c48e6186718b7b290ceed9369a1a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\is-050AS.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-050AS.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp" /SL5="$501E6,422409,257536,C:\Users\Admin\AppData\Local\Temp\foo\9b8c48e6186718b7b290ceed9369a1a4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN VKDJ /SC ONLOGON /TR "C:\ProgramData\VkontakteDJ\VkontakteDJ.exe /H" /F /DELAY 0001:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-050AS.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp

MD5
1ed8c4d743c37c3cfae25e18b4c558eb

SHA1
5d7f687101ee48cb4812f592e8543a133c55777f

SHA256
e9950920fd95c6c16f163304ed234c01968a0801523baccf7fcff3d16025bd9e

SHA512
f0360ba649dedf5ec37f0a4dd7a296635b068840b0521117048d11628292527c95a3979421b89b3e0c391f2566bfe936bda5a38b3ff912ede9884e3e5024a190

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-050AS.tmp\9b8c48e6186718b7b290ceed9369a1a4.tmp

MD5
1ed8c4d743c37c3cfae25e18b4c558eb

SHA1
5d7f687101ee48cb4812f592e8543a133c55777f

SHA256
e9950920fd95c6c16f163304ed234c01968a0801523baccf7fcff3d16025bd9e

SHA512
f0360ba649dedf5ec37f0a4dd7a296635b068840b0521117048d11628292527c95a3979421b89b3e0c391f2566bfe936bda5a38b3ff912ede9884e3e5024a190

Download Submit
\Users\Admin\AppData\Local\Temp\is-QS94O.tmp\idp.dll

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
memory/3836-0-0x0000000000000000-mapping.dmp

Download
memory/3936-4-0x0000000000000000-mapping.dmp

Download