Analysis
- max time kernel
150s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
006252b08e8a073c31d43cc03e1df107.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
006252b08e8a073c31d43cc03e1df107.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 006252b08e8a073c31d43cc03e1df107.exe
- Size 2.7MB
- Sample201117-vc9drkhrya
- SHA256 c5e37df6c487b736d8d99416fe6199c425cfd713b633f15e2d7f4c379331d712
- MD5 7744c06d0fea9cd0180167b9e5de2494
- SHA1 7dce7ae675e3239682b3a510566f4eff257622ce
- SHA512 bba7331960bf703d3a7384fd80bfb44549a54d659309d12559cf38601f8f273f7e90706aa55364951d1f2d9fb420efbaff3423f12400d49da62b5da3b7288eb6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\Label\\System.exe" y4wizt5q.gsa.exe - Executes dropped EXE 6 IoCs
pid Process 3292 Install.sfx.exe 2800 Install.exe 2844 y4wizt5q.gsa.exe 3728 eiqowt2n.3pa.exe 3340 eiqowt2n.3pa.tmp 1300 System.exe -
resource yara_rule behavioral2/files/0x000100000001ab76-9.dat upx behavioral2/files/0x000100000001ab76-10.dat upx behavioral2/files/0x000100000001ab84-18.dat upx behavioral2/files/0x000100000001ab84-19.dat upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\Documents\\Label\\System.exe" y4wizt5q.gsa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\Documents\\Label\\System.exe" System.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2844 y4wizt5q.gsa.exe Token: SeSecurityPrivilege 2844 y4wizt5q.gsa.exe Token: SeTakeOwnershipPrivilege 2844 y4wizt5q.gsa.exe Token: SeLoadDriverPrivilege 2844 y4wizt5q.gsa.exe Token: SeSystemProfilePrivilege 2844 y4wizt5q.gsa.exe Token: SeSystemtimePrivilege 2844 y4wizt5q.gsa.exe Token: SeProfSingleProcessPrivilege 2844 y4wizt5q.gsa.exe Token: SeIncBasePriorityPrivilege 2844 y4wizt5q.gsa.exe Token: SeCreatePagefilePrivilege 2844 y4wizt5q.gsa.exe Token: SeBackupPrivilege 2844 y4wizt5q.gsa.exe Token: SeRestorePrivilege 2844 y4wizt5q.gsa.exe Token: SeShutdownPrivilege 2844 y4wizt5q.gsa.exe Token: SeDebugPrivilege 2844 y4wizt5q.gsa.exe Token: SeSystemEnvironmentPrivilege 2844 y4wizt5q.gsa.exe Token: SeChangeNotifyPrivilege 2844 y4wizt5q.gsa.exe Token: SeRemoteShutdownPrivilege 2844 y4wizt5q.gsa.exe Token: SeUndockPrivilege 2844 y4wizt5q.gsa.exe Token: SeManageVolumePrivilege 2844 y4wizt5q.gsa.exe Token: SeImpersonatePrivilege 2844 y4wizt5q.gsa.exe Token: SeCreateGlobalPrivilege 2844 y4wizt5q.gsa.exe Token: 33 2844 y4wizt5q.gsa.exe Token: 34 2844 y4wizt5q.gsa.exe Token: 35 2844 y4wizt5q.gsa.exe Token: 36 2844 y4wizt5q.gsa.exe Token: SeIncreaseQuotaPrivilege 1300 System.exe Token: SeSecurityPrivilege 1300 System.exe Token: SeTakeOwnershipPrivilege 1300 System.exe Token: SeLoadDriverPrivilege 1300 System.exe Token: SeSystemProfilePrivilege 1300 System.exe Token: SeSystemtimePrivilege 1300 System.exe Token: SeProfSingleProcessPrivilege 1300 System.exe Token: SeIncBasePriorityPrivilege 1300 System.exe Token: SeCreatePagefilePrivilege 1300 System.exe Token: SeBackupPrivilege 1300 System.exe Token: SeRestorePrivilege 1300 System.exe Token: SeShutdownPrivilege 1300 System.exe Token: SeDebugPrivilege 1300 System.exe Token: SeSystemEnvironmentPrivilege 1300 System.exe Token: SeChangeNotifyPrivilege 1300 System.exe Token: SeRemoteShutdownPrivilege 1300 System.exe Token: SeUndockPrivilege 1300 System.exe Token: SeManageVolumePrivilege 1300 System.exe Token: SeImpersonatePrivilege 1300 System.exe Token: SeCreateGlobalPrivilege 1300 System.exe Token: 33 1300 System.exe Token: 34 1300 System.exe Token: 35 1300 System.exe Token: 36 1300 System.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1300 System.exe - Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3448 2208 006252b08e8a073c31d43cc03e1df107.exe 75 PID 2208 wrote to memory of 3448 2208 006252b08e8a073c31d43cc03e1df107.exe 75 PID 2208 wrote to memory of 3448 2208 006252b08e8a073c31d43cc03e1df107.exe 75 PID 3448 wrote to memory of 3292 3448 cmd.exe 78 PID 3448 wrote to memory of 3292 3448 cmd.exe 78 PID 3448 wrote to memory of 3292 3448 cmd.exe 78 PID 3292 wrote to memory of 2800 3292 Install.sfx.exe 79 PID 3292 wrote to memory of 2800 3292 Install.sfx.exe 79 PID 3292 wrote to memory of 2800 3292 Install.sfx.exe 79 PID 2800 wrote to memory of 2844 2800 Install.exe 80 PID 2800 wrote to memory of 2844 2800 Install.exe 80 PID 2800 wrote to memory of 2844 2800 Install.exe 80 PID 2800 wrote to memory of 3728 2800 Install.exe 81 PID 2800 wrote to memory of 3728 2800 Install.exe 81 PID 2800 wrote to memory of 3728 2800 Install.exe 81 PID 3728 wrote to memory of 3340 3728 eiqowt2n.3pa.exe 82 PID 3728 wrote to memory of 3340 3728 eiqowt2n.3pa.exe 82 PID 3728 wrote to memory of 3340 3728 eiqowt2n.3pa.exe 82 PID 2844 wrote to memory of 1300 2844 y4wizt5q.gsa.exe 83 PID 2844 wrote to memory of 1300 2844 y4wizt5q.gsa.exe 83 PID 2844 wrote to memory of 1300 2844 y4wizt5q.gsa.exe 83 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 1300 wrote to memory of 3132 1300 System.exe 84 PID 3448 wrote to memory of 3852 3448 cmd.exe 85 PID 3448 wrote to memory of 3852 3448 cmd.exe 85 PID 3448 wrote to memory of 3852 3448 cmd.exe 85 PID 3448 wrote to memory of 2292 3448 cmd.exe 86 PID 3448 wrote to memory of 2292 3448 cmd.exe 86 PID 3448 wrote to memory of 2292 3448 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\006252b08e8a073c31d43cc03e1df107.exe"C:\Users\Admin\AppData\Local\Temp\006252b08e8a073c31d43cc03e1df107.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Decrypt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.sfx.exeInstall.sfx.exe -pdingdingdingdogdomgngfjnsjnfg -d\Users\Admin\AppData\Roaming\3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\y4wizt5q.gsa.exe"C:\Users\Admin\AppData\Local\Temp\y4wizt5q.gsa.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\Documents\Label\System.exe"C:\Users\Admin\Documents\Label\System.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\notepad.exenotepad7⤵PID:3132
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\eiqowt2n.3pa.exe"C:\Users\Admin\AppData\Local\Temp\eiqowt2n.3pa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\is-AS1EG.tmp\eiqowt2n.3pa.tmp"C:\Users\Admin\AppData\Local\Temp\is-AS1EG.tmp\eiqowt2n.3pa.tmp" /SL5="$10204,56832,0,C:\Users\Admin\AppData\Local\Temp\eiqowt2n.3pa.exe"6⤵
- Executes dropped EXE
PID:3340
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO Y "3⤵PID:3852
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /s "\Users\Admin\AppData\Roaming\Install.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"3⤵
- Enumerates system info in registry
PID:2292
-
-