Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20201028 - submitted
15/11/2020, 23:17
Static task
static1
Behavioral task
behavioral1
Sample
322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92.exe
- Size 2.7MB
- Sample201115-8k8gtrsrr6
- SHA256 322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92
- MD5 d06ec19cad60129ace73ff1a6b714af1
- SHA1 b7fdc0d375f7b228689a178e3f8a6b551c781ac6
- SHA512 da76a4fd20b9f4999a710b053993ae6a68aec61b4620b3331789bb47b8def6b288aeeb44e4bccdf21e9b3096169af0bea3641f8b2a14a720b43c19833bd48b8c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\Label\\System.exe" zjko1coh.fpy.exe - Executes dropped EXE 6 IoCs
pid Process 2560 Install.sfx.exe 2624 Install.exe 1444 zjko1coh.fpy.exe 2144 e4r0cgr4.jb3.exe 4080 e4r0cgr4.jb3.tmp 3964 System.exe -
resource yara_rule behavioral2/files/0x000100000001ab90-10.dat upx behavioral2/files/0x000100000001ab90-11.dat upx behavioral2/files/0x000100000001ab99-19.dat upx behavioral2/files/0x000100000001ab99-20.dat upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\Documents\\Label\\System.exe" zjko1coh.fpy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\Documents\\Label\\System.exe" System.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1444 zjko1coh.fpy.exe Token: SeSecurityPrivilege 1444 zjko1coh.fpy.exe Token: SeTakeOwnershipPrivilege 1444 zjko1coh.fpy.exe Token: SeLoadDriverPrivilege 1444 zjko1coh.fpy.exe Token: SeSystemProfilePrivilege 1444 zjko1coh.fpy.exe Token: SeSystemtimePrivilege 1444 zjko1coh.fpy.exe Token: SeProfSingleProcessPrivilege 1444 zjko1coh.fpy.exe Token: SeIncBasePriorityPrivilege 1444 zjko1coh.fpy.exe Token: SeCreatePagefilePrivilege 1444 zjko1coh.fpy.exe Token: SeBackupPrivilege 1444 zjko1coh.fpy.exe Token: SeRestorePrivilege 1444 zjko1coh.fpy.exe Token: SeShutdownPrivilege 1444 zjko1coh.fpy.exe Token: SeDebugPrivilege 1444 zjko1coh.fpy.exe Token: SeSystemEnvironmentPrivilege 1444 zjko1coh.fpy.exe Token: SeChangeNotifyPrivilege 1444 zjko1coh.fpy.exe Token: SeRemoteShutdownPrivilege 1444 zjko1coh.fpy.exe Token: SeUndockPrivilege 1444 zjko1coh.fpy.exe Token: SeManageVolumePrivilege 1444 zjko1coh.fpy.exe Token: SeImpersonatePrivilege 1444 zjko1coh.fpy.exe Token: SeCreateGlobalPrivilege 1444 zjko1coh.fpy.exe Token: 33 1444 zjko1coh.fpy.exe Token: 34 1444 zjko1coh.fpy.exe Token: 35 1444 zjko1coh.fpy.exe Token: 36 1444 zjko1coh.fpy.exe Token: SeIncreaseQuotaPrivilege 3964 System.exe Token: SeSecurityPrivilege 3964 System.exe Token: SeTakeOwnershipPrivilege 3964 System.exe Token: SeLoadDriverPrivilege 3964 System.exe Token: SeSystemProfilePrivilege 3964 System.exe Token: SeSystemtimePrivilege 3964 System.exe Token: SeProfSingleProcessPrivilege 3964 System.exe Token: SeIncBasePriorityPrivilege 3964 System.exe Token: SeCreatePagefilePrivilege 3964 System.exe Token: SeBackupPrivilege 3964 System.exe Token: SeRestorePrivilege 3964 System.exe Token: SeShutdownPrivilege 3964 System.exe Token: SeDebugPrivilege 3964 System.exe Token: SeSystemEnvironmentPrivilege 3964 System.exe Token: SeChangeNotifyPrivilege 3964 System.exe Token: SeRemoteShutdownPrivilege 3964 System.exe Token: SeUndockPrivilege 3964 System.exe Token: SeManageVolumePrivilege 3964 System.exe Token: SeImpersonatePrivilege 3964 System.exe Token: SeCreateGlobalPrivilege 3964 System.exe Token: 33 3964 System.exe Token: 34 3964 System.exe Token: 35 3964 System.exe Token: 36 3964 System.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3964 System.exe - Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2732 1304 322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92.exe 75 PID 1304 wrote to memory of 2732 1304 322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92.exe 75 PID 1304 wrote to memory of 2732 1304 322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92.exe 75 PID 2732 wrote to memory of 2560 2732 cmd.exe 78 PID 2732 wrote to memory of 2560 2732 cmd.exe 78 PID 2732 wrote to memory of 2560 2732 cmd.exe 78 PID 2560 wrote to memory of 2624 2560 Install.sfx.exe 79 PID 2560 wrote to memory of 2624 2560 Install.sfx.exe 79 PID 2560 wrote to memory of 2624 2560 Install.sfx.exe 79 PID 2624 wrote to memory of 1444 2624 Install.exe 80 PID 2624 wrote to memory of 1444 2624 Install.exe 80 PID 2624 wrote to memory of 1444 2624 Install.exe 80 PID 2624 wrote to memory of 2144 2624 Install.exe 81 PID 2624 wrote to memory of 2144 2624 Install.exe 81 PID 2624 wrote to memory of 2144 2624 Install.exe 81 PID 2144 wrote to memory of 4080 2144 e4r0cgr4.jb3.exe 82 PID 2144 wrote to memory of 4080 2144 e4r0cgr4.jb3.exe 82 PID 2144 wrote to memory of 4080 2144 e4r0cgr4.jb3.exe 82 PID 1444 wrote to memory of 3964 1444 zjko1coh.fpy.exe 83 PID 1444 wrote to memory of 3964 1444 zjko1coh.fpy.exe 83 PID 1444 wrote to memory of 3964 1444 zjko1coh.fpy.exe 83 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 3964 wrote to memory of 2568 3964 System.exe 84 PID 2732 wrote to memory of 1272 2732 cmd.exe 85 PID 2732 wrote to memory of 1272 2732 cmd.exe 85 PID 2732 wrote to memory of 1272 2732 cmd.exe 85 PID 2732 wrote to memory of 2464 2732 cmd.exe 86 PID 2732 wrote to memory of 2464 2732 cmd.exe 86 PID 2732 wrote to memory of 2464 2732 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92.exe"C:\Users\Admin\AppData\Local\Temp\322e7e8f9e04fe6ed8746af0687d4deb16e7d2e7ddcd9715a19dc7da033c0f92.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Decrypt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.sfx.exeInstall.sfx.exe -pdingdingdingdogdomgngfjnsjnfg -d\Users\Admin\AppData\Roaming\3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\zjko1coh.fpy.exe"C:\Users\Admin\AppData\Local\Temp\zjko1coh.fpy.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\Documents\Label\System.exe"C:\Users\Admin\Documents\Label\System.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\notepad.exenotepad7⤵PID:2568
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e4r0cgr4.jb3.exe"C:\Users\Admin\AppData\Local\Temp\e4r0cgr4.jb3.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\is-39CQO.tmp\e4r0cgr4.jb3.tmp"C:\Users\Admin\AppData\Local\Temp\is-39CQO.tmp\e4r0cgr4.jb3.tmp" /SL5="$201F4,56832,0,C:\Users\Admin\AppData\Local\Temp\e4r0cgr4.jb3.exe"6⤵
- Executes dropped EXE
PID:4080
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO Y "3⤵PID:1272
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /s "\Users\Admin\AppData\Roaming\Install.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"3⤵
- Enumerates system info in registry
PID:2464
-
-