Analysis
- max time kernel
151s - max time network
120s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/11/2020, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
006252b08e8a073c31d43cc03e1df107.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
006252b08e8a073c31d43cc03e1df107.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 006252b08e8a073c31d43cc03e1df107.exe
- Size 2.7MB
- Sample201117-vc9drkhrya
- SHA256 c5e37df6c487b736d8d99416fe6199c425cfd713b633f15e2d7f4c379331d712
- MD5 7744c06d0fea9cd0180167b9e5de2494
- SHA1 7dce7ae675e3239682b3a510566f4eff257622ce
- SHA512 bba7331960bf703d3a7384fd80bfb44549a54d659309d12559cf38601f8f273f7e90706aa55364951d1f2d9fb420efbaff3423f12400d49da62b5da3b7288eb6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\Label\\System.exe" x0rbb34h.1hh.exe - Executes dropped EXE 6 IoCs
pid Process 1740 Install.sfx.exe 1484 Install.exe 1016 x0rbb34h.1hh.exe 1336 lvd2u4eg.wcd.exe 848 System.exe 2020 lvd2u4eg.wcd.tmp -
resource yara_rule behavioral1/files/0x00030000000130f6-17.dat upx behavioral1/files/0x00030000000130f6-18.dat upx behavioral1/files/0x00030000000130f6-20.dat upx behavioral1/files/0x00030000000130f6-25.dat upx behavioral1/files/0x00030000000130fb-26.dat upx behavioral1/files/0x00030000000130fb-27.dat upx behavioral1/files/0x00030000000130fb-29.dat upx - Loads dropped DLL 13 IoCs
pid Process 1184 cmd.exe 1740 Install.sfx.exe 1740 Install.sfx.exe 1740 Install.sfx.exe 1740 Install.sfx.exe 1484 Install.exe 1484 Install.exe 1484 Install.exe 1016 x0rbb34h.1hh.exe 1016 x0rbb34h.1hh.exe 1336 lvd2u4eg.wcd.exe 2020 lvd2u4eg.wcd.tmp 2020 lvd2u4eg.wcd.tmp - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\Documents\\Label\\System.exe" x0rbb34h.1hh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\Documents\\Label\\System.exe" System.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2020 lvd2u4eg.wcd.tmp - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1016 x0rbb34h.1hh.exe Token: SeSecurityPrivilege 1016 x0rbb34h.1hh.exe Token: SeTakeOwnershipPrivilege 1016 x0rbb34h.1hh.exe Token: SeLoadDriverPrivilege 1016 x0rbb34h.1hh.exe Token: SeSystemProfilePrivilege 1016 x0rbb34h.1hh.exe Token: SeSystemtimePrivilege 1016 x0rbb34h.1hh.exe Token: SeProfSingleProcessPrivilege 1016 x0rbb34h.1hh.exe Token: SeIncBasePriorityPrivilege 1016 x0rbb34h.1hh.exe Token: SeCreatePagefilePrivilege 1016 x0rbb34h.1hh.exe Token: SeBackupPrivilege 1016 x0rbb34h.1hh.exe Token: SeRestorePrivilege 1016 x0rbb34h.1hh.exe Token: SeShutdownPrivilege 1016 x0rbb34h.1hh.exe Token: SeDebugPrivilege 1016 x0rbb34h.1hh.exe Token: SeSystemEnvironmentPrivilege 1016 x0rbb34h.1hh.exe Token: SeChangeNotifyPrivilege 1016 x0rbb34h.1hh.exe Token: SeRemoteShutdownPrivilege 1016 x0rbb34h.1hh.exe Token: SeUndockPrivilege 1016 x0rbb34h.1hh.exe Token: SeManageVolumePrivilege 1016 x0rbb34h.1hh.exe Token: SeImpersonatePrivilege 1016 x0rbb34h.1hh.exe Token: SeCreateGlobalPrivilege 1016 x0rbb34h.1hh.exe Token: 33 1016 x0rbb34h.1hh.exe Token: 34 1016 x0rbb34h.1hh.exe Token: 35 1016 x0rbb34h.1hh.exe Token: SeIncreaseQuotaPrivilege 848 System.exe Token: SeSecurityPrivilege 848 System.exe Token: SeTakeOwnershipPrivilege 848 System.exe Token: SeLoadDriverPrivilege 848 System.exe Token: SeSystemProfilePrivilege 848 System.exe Token: SeSystemtimePrivilege 848 System.exe Token: SeProfSingleProcessPrivilege 848 System.exe Token: SeIncBasePriorityPrivilege 848 System.exe Token: SeCreatePagefilePrivilege 848 System.exe Token: SeBackupPrivilege 848 System.exe Token: SeRestorePrivilege 848 System.exe Token: SeShutdownPrivilege 848 System.exe Token: SeDebugPrivilege 848 System.exe Token: SeSystemEnvironmentPrivilege 848 System.exe Token: SeChangeNotifyPrivilege 848 System.exe Token: SeRemoteShutdownPrivilege 848 System.exe Token: SeUndockPrivilege 848 System.exe Token: SeManageVolumePrivilege 848 System.exe Token: SeImpersonatePrivilege 848 System.exe Token: SeCreateGlobalPrivilege 848 System.exe Token: 33 848 System.exe Token: 34 848 System.exe Token: 35 848 System.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 848 System.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 240 wrote to memory of 1184 240 006252b08e8a073c31d43cc03e1df107.exe 26 PID 240 wrote to memory of 1184 240 006252b08e8a073c31d43cc03e1df107.exe 26 PID 240 wrote to memory of 1184 240 006252b08e8a073c31d43cc03e1df107.exe 26 PID 240 wrote to memory of 1184 240 006252b08e8a073c31d43cc03e1df107.exe 26 PID 1184 wrote to memory of 1740 1184 cmd.exe 30 PID 1184 wrote to memory of 1740 1184 cmd.exe 30 PID 1184 wrote to memory of 1740 1184 cmd.exe 30 PID 1184 wrote to memory of 1740 1184 cmd.exe 30 PID 1184 wrote to memory of 1740 1184 cmd.exe 30 PID 1184 wrote to memory of 1740 1184 cmd.exe 30 PID 1184 wrote to memory of 1740 1184 cmd.exe 30 PID 1740 wrote to memory of 1484 1740 Install.sfx.exe 32 PID 1740 wrote to memory of 1484 1740 Install.sfx.exe 32 PID 1740 wrote to memory of 1484 1740 Install.sfx.exe 32 PID 1740 wrote to memory of 1484 1740 Install.sfx.exe 32 PID 1740 wrote to memory of 1484 1740 Install.sfx.exe 32 PID 1740 wrote to memory of 1484 1740 Install.sfx.exe 32 PID 1740 wrote to memory of 1484 1740 Install.sfx.exe 32 PID 1484 wrote to memory of 1016 1484 Install.exe 33 PID 1484 wrote to memory of 1016 1484 Install.exe 33 PID 1484 wrote to memory of 1016 1484 Install.exe 33 PID 1484 wrote to memory of 1016 1484 Install.exe 33 PID 1484 wrote to memory of 1336 1484 Install.exe 34 PID 1484 wrote to memory of 1336 1484 Install.exe 34 PID 1484 wrote to memory of 1336 1484 Install.exe 34 PID 1484 wrote to memory of 1336 1484 Install.exe 34 PID 1016 wrote to memory of 848 1016 x0rbb34h.1hh.exe 35 PID 1016 wrote to memory of 848 1016 x0rbb34h.1hh.exe 35 PID 1016 wrote to memory of 848 1016 x0rbb34h.1hh.exe 35 PID 1016 wrote to memory of 848 1016 x0rbb34h.1hh.exe 35 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 1336 wrote to memory of 2020 1336 lvd2u4eg.wcd.exe 37 PID 1336 wrote to memory of 2020 1336 lvd2u4eg.wcd.exe 37 PID 1336 wrote to memory of 2020 1336 lvd2u4eg.wcd.exe 37 PID 1336 wrote to memory of 2020 1336 lvd2u4eg.wcd.exe 37 PID 1336 wrote to memory of 2020 1336 lvd2u4eg.wcd.exe 37 PID 1336 wrote to memory of 2020 1336 lvd2u4eg.wcd.exe 37 PID 1336 wrote to memory of 2020 1336 lvd2u4eg.wcd.exe 37 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 848 wrote to memory of 744 848 System.exe 36 PID 1184 wrote to memory of 1636 1184 cmd.exe 38 PID 1184 wrote to memory of 1636 1184 cmd.exe 38 PID 1184 wrote to memory of 1636 1184 cmd.exe 38 PID 1184 wrote to memory of 1636 1184 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\006252b08e8a073c31d43cc03e1df107.exe"C:\Users\Admin\AppData\Local\Temp\006252b08e8a073c31d43cc03e1df107.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Decrypt.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.sfx.exeInstall.sfx.exe -pdingdingdingdogdomgngfjnsjnfg -d\Users\Admin\AppData\Roaming\3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\x0rbb34h.1hh.exe"C:\Users\Admin\AppData\Local\Temp\x0rbb34h.1hh.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\Documents\Label\System.exe"C:\Users\Admin\Documents\Label\System.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\notepad.exenotepad7⤵PID:744
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lvd2u4eg.wcd.exe"C:\Users\Admin\AppData\Local\Temp\lvd2u4eg.wcd.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\is-I0M08.tmp\lvd2u4eg.wcd.tmp"C:\Users\Admin\AppData\Local\Temp\is-I0M08.tmp\lvd2u4eg.wcd.tmp" /SL5="$2019A,56832,0,C:\Users\Admin\AppData\Local\Temp\lvd2u4eg.wcd.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2020
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO Y "3⤵PID:1636
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /s "\Users\Admin\AppData\Roaming\Install.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"3⤵
- Enumerates system info in registry
PID:1732
-
-