Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows7_x64 -
resource
win7 -
submitted
15-10-2020 23:03
Static task
static1
Behavioral task
behavioral1
Sample
vpFeuLfJ.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vpFeuLfJ.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
vpFeuLfJ.exe
-
Size
33KB
-
MD5
0613e9a0b44d56f9203f838b07932f84
-
SHA1
952038465310a43a6741ba20d38e1a0c9d28ead1
-
SHA256
d607e4cf6254db79c5a50a6e59c25f9387951f545da0b1475719209d8d357f64
-
SHA512
fb18ab1740d048cfa0b13b051b16f7faf20c6c1a026f526688586fa04aec923f52e198418c8e7b0f024a9a5a3dcc794a44bd14409e7b8f8cfad214286a963d80
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 320 Server.exe 1332 Server.exe 2012 Server.exe 936 Server.exe -
Modifies Installed Components in the registry 2 TTPs
-
resource yara_rule behavioral1/memory/1060-0-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/files/0x00040000000131c9-2.dat upx behavioral1/memory/1948-5-0x0000000030000000-0x00000000300C5000-memory.dmp upx behavioral1/memory/1948-7-0x0000000030000000-0x00000000300C5000-memory.dmp upx behavioral1/memory/1948-9-0x0000000030000000-0x00000000300C5000-memory.dmp upx behavioral1/memory/1948-12-0x0000000030000000-0x00000000300C5000-memory.dmp upx behavioral1/files/0x00040000000131c9-13.dat upx behavioral1/files/0x00040000000131c9-14.dat upx behavioral1/files/0x00040000000131c9-16.dat upx behavioral1/files/0x00040000000131c9-19.dat upx behavioral1/memory/1332-25-0x0000000030000000-0x00000000300C5000-memory.dmp upx behavioral1/files/0x00040000000131c9-28.dat upx behavioral1/memory/1332-29-0x0000000030000000-0x00000000300C5000-memory.dmp upx behavioral1/files/0x00040000000131c9-31.dat upx behavioral1/files/0x00040000000131c9-30.dat upx behavioral1/files/0x00040000000131c9-33.dat upx behavioral1/files/0x00040000000131c9-35.dat upx behavioral1/files/0x00040000000131c9-44.dat upx behavioral1/memory/936-45-0x0000000030000000-0x00000000300C5000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 1060 svchost.exe 1060 svchost.exe 320 Server.exe 1060 svchost.exe 1060 svchost.exe 2012 Server.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe" svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1100 set thread context of 1948 1100 vpFeuLfJ.exe 31 PID 320 set thread context of 1332 320 Server.exe 33 PID 2012 set thread context of 936 2012 Server.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Server.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1100 vpFeuLfJ.exe 320 Server.exe 2012 Server.exe 936 Server.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1060 1100 vpFeuLfJ.exe 25 PID 1100 wrote to memory of 1060 1100 vpFeuLfJ.exe 25 PID 1100 wrote to memory of 1060 1100 vpFeuLfJ.exe 25 PID 1100 wrote to memory of 1060 1100 vpFeuLfJ.exe 25 PID 1100 wrote to memory of 1060 1100 vpFeuLfJ.exe 25 PID 1100 wrote to memory of 1948 1100 vpFeuLfJ.exe 31 PID 1100 wrote to memory of 1948 1100 vpFeuLfJ.exe 31 PID 1100 wrote to memory of 1948 1100 vpFeuLfJ.exe 31 PID 1100 wrote to memory of 1948 1100 vpFeuLfJ.exe 31 PID 1100 wrote to memory of 1948 1100 vpFeuLfJ.exe 31 PID 1100 wrote to memory of 1948 1100 vpFeuLfJ.exe 31 PID 1100 wrote to memory of 1948 1100 vpFeuLfJ.exe 31 PID 1100 wrote to memory of 1948 1100 vpFeuLfJ.exe 31 PID 1060 wrote to memory of 320 1060 svchost.exe 32 PID 1060 wrote to memory of 320 1060 svchost.exe 32 PID 1060 wrote to memory of 320 1060 svchost.exe 32 PID 1060 wrote to memory of 320 1060 svchost.exe 32 PID 320 wrote to memory of 1332 320 Server.exe 33 PID 320 wrote to memory of 1332 320 Server.exe 33 PID 320 wrote to memory of 1332 320 Server.exe 33 PID 320 wrote to memory of 1332 320 Server.exe 33 PID 320 wrote to memory of 1332 320 Server.exe 33 PID 320 wrote to memory of 1332 320 Server.exe 33 PID 320 wrote to memory of 1332 320 Server.exe 33 PID 320 wrote to memory of 1332 320 Server.exe 33 PID 1060 wrote to memory of 2012 1060 svchost.exe 34 PID 1060 wrote to memory of 2012 1060 svchost.exe 34 PID 1060 wrote to memory of 2012 1060 svchost.exe 34 PID 1060 wrote to memory of 2012 1060 svchost.exe 34 PID 2012 wrote to memory of 936 2012 Server.exe 35 PID 2012 wrote to memory of 936 2012 Server.exe 35 PID 2012 wrote to memory of 936 2012 Server.exe 35 PID 2012 wrote to memory of 936 2012 Server.exe 35 PID 2012 wrote to memory of 936 2012 Server.exe 35 PID 2012 wrote to memory of 936 2012 Server.exe 35 PID 2012 wrote to memory of 936 2012 Server.exe 35 PID 2012 wrote to memory of 936 2012 Server.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\vpFeuLfJ.exe"C:\Users\Admin\AppData\Local\Temp\vpFeuLfJ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exe"C:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exeC:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exe4⤵
- Executes dropped EXE
PID:1332
-
-
-
C:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exe"C:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exeC:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exe4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:936
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\vpFeuLfJ.exeC:\Users\Admin\AppData\Local\Temp\vpFeuLfJ.exe2⤵PID:1948
-