Analysis
-
max time kernel
151s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe
Resource
win10v20201028
General
-
Target
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe
-
Size
94KB
-
MD5
69f1172b3f31746992b86467578d5ab2
-
SHA1
f24491dc99ad02f0d1c502b312df0b51670db738
-
SHA256
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe
-
SHA512
a893f5d07f3db175eec9441197b499ce856a089386a2d95f0dd4cd37734e060f9216125425f229841e8a8c825dddc2c26e82ccd41d802d7f55dbf0ea321b7c46
Malware Config
Extracted
C:\DC9F2-Readme.txt
netwalker
sevenoneone@cock.li
kavariusing@tutanota.com
Extracted
C:\Program Files (x86)\Microsoft Office\Templates\1033\DC9F2-Readme.txt
netwalker
sevenoneone@cock.li
kavariusing@tutanota.com
Signatures
-
Detected Netwalker Ransomware 2 IoCs
Detected unpacked Netwalker executable.
Processes:
resource yara_rule behavioral1/memory/1892-1-0x0000000000070000-0x000000000008B000-memory.dmp netwalker_ransomware behavioral1/memory/1344-3-0x0000000000470000-0x000000000048B000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
Processes:
explorer.exepid process 1344 explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc9f2fac = "C:\\Program Files (x86)\\dc9f2fac\\dc9f2fac.exe" explorer.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exeexplorer.exedescription pid process target process PID 1892 set thread context of 1344 1892 209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe explorer.exe PID 1344 set thread context of 1236 1344 explorer.exe explorer.exe -
Drops file in Program Files directory 7475 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099198.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02218_.GIF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FORM.JS explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21435_.GIF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\DC9F2-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02106_.GIF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02617_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01575_.WMF explorer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\DC9F2-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086426.WMF explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DC9F2-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG.HXS explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFRES.CFG explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4 explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157831.WMF explorer.exe File opened for modification C:\Program Files\ConvertToPing.wav explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152702.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292278.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0292020.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZUSR12.ACCDU explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBCALSO.POC explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02120_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHigh.jpg explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\DC9F2-Readme.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api explorer.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\DC9F2-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387337.JPG explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212219.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21427_.GIF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15156_.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14980_.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215210.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL103.XML explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ODBC.SAM explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\EUROTOOL.XLAM explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212299.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00373_.WMF explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\fr.pak explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1424 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 19391 IoCs
Processes:
explorer.exeexplorer.exepid process 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exeexplorer.exepid process 1892 209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe 1344 explorer.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
explorer.exevssvc.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1236 explorer.exe Token: SeBackupPrivilege 1540 vssvc.exe Token: SeRestorePrivilege 1540 vssvc.exe Token: SeAuditPrivilege 1540 vssvc.exe Token: SeDebugPrivilege 1344 explorer.exe Token: SeImpersonatePrivilege 1344 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exeexplorer.exeexplorer.exedescription pid process target process PID 1892 wrote to memory of 1344 1892 209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe explorer.exe PID 1892 wrote to memory of 1344 1892 209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe explorer.exe PID 1892 wrote to memory of 1344 1892 209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe explorer.exe PID 1892 wrote to memory of 1344 1892 209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe explorer.exe PID 1344 wrote to memory of 1236 1344 explorer.exe explorer.exe PID 1344 wrote to memory of 1236 1344 explorer.exe explorer.exe PID 1344 wrote to memory of 1236 1344 explorer.exe explorer.exe PID 1344 wrote to memory of 1236 1344 explorer.exe explorer.exe PID 1236 wrote to memory of 1424 1236 explorer.exe vssadmin.exe PID 1236 wrote to memory of 1424 1236 explorer.exe vssadmin.exe PID 1236 wrote to memory of 1424 1236 explorer.exe vssadmin.exe PID 1236 wrote to memory of 1424 1236 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe"C:\Users\Admin\AppData\Local\Temp\209779474d4b8e7246245092e7d094ce5730c5c1d36bc03d9b8120f211dc3ebe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"2⤵
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1236-2-0x0000000000000000-mapping.dmp
-
memory/1344-0-0x0000000000000000-mapping.dmp
-
memory/1344-3-0x0000000000470000-0x000000000048B000-memory.dmpFilesize
108KB
-
memory/1424-4-0x0000000000000000-mapping.dmp
-
memory/1892-1-0x0000000000070000-0x000000000008B000-memory.dmpFilesize
108KB