Overview
overview
10Static
static
81.bin/1.bin.exe
windows7_x64
101.bin/1.bin.exe
windows10_x64
102019-09-02...10.exe
windows7_x64
102019-09-02...10.exe
windows10_x64
1031.exe
windows7_x64
1031.exe
windows10_x64
103DMark 11 ...on.exe
windows7_x64
13DMark 11 ...on.exe
windows10_x64
15da0116af4...18.exe
windows7_x64
85da0116af4...18.exe
windows10_x64
8Archive.zi...3e.exe
windows7_x64
8Archive.zi...3e.exe
windows10_x64
8CVE-2018-1...oC.swf
windows7_x64
3CVE-2018-1...oC.swf
windows10_x64
3CVWSHSetup...1].exe
windows7_x64
3CVWSHSetup...1].exe
windows10_x64
3DiskIntern...en.exe
windows7_x64
1DiskIntern...en.exe
windows10_x64
1ForceOp 2....ce.exe
windows7_x64
10ForceOp 2....ce.exe
windows10_x64
10HYDRA.exe
windows7_x64
10HYDRA.exe
windows10_x64
10Keygen.exe
windows7_x64
10Keygen.exe
windows10_x64
10Lonelyscre...ox.exe
windows7_x64
1Lonelyscre...ox.exe
windows10_x64
1LtHv0O2KZDK4M637.exe
windows7_x64
10LtHv0O2KZDK4M637.exe
windows10_x64
10Magic_File...ja.exe
windows7_x64
1Magic_File...ja.exe
windows10_x64
1OnlineInstaller.exe
windows7_x64
8OnlineInstaller.exe
windows10_x64
8Analysis
-
max time kernel
62s -
max time network
128s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 16:58
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1.bin/1.bin.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
2019-09-02_22-41-10.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
31.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
CVE-2018-15982_PoC.swf
Resource
win7v20201028
Behavioral task
behavioral14
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral15
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
HYDRA.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
HYDRA.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
Keygen.exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
Keygen.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win7v20201028
Behavioral task
behavioral26
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
LtHv0O2KZDK4M637.exe
Resource
win7v20201028
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win7v20201028
Behavioral task
behavioral30
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
OnlineInstaller.exe
Resource
win7v20201028
Behavioral task
behavioral32
Sample
OnlineInstaller.exe
Resource
win10v20201028
General
-
Target
ForceOp 2.8.7 - By RaiSence.exe
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Suspicious use of NtCreateProcessExOtherParentProcess ⋅ 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1628 created 3232 1628 WerFault.exe sihost.exe -
Executes dropped EXE ⋅ 2 IoCs
Processes:
wincommon.exesihost.exepid process 2164 wincommon.exe 3232 sihost.exe -
Drops file in Program Files directory ⋅ 2 IoCs
Processes:
wincommon.exedescription ioc process File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\svchost.exe wincommon.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\f4d236fdec2fd03914189c3b26e5cb0dfea9d761 wincommon.exe -
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash ⋅ 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1628 3232 WerFault.exe sihost.exe -
Creates scheduled task(s) ⋅ 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
TTPs:
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1084 schtasks.exe 3468 schtasks.exe 3268 schtasks.exe 4024 schtasks.exe 2368 schtasks.exe -
Modifies registry class ⋅ 1 IoCs
Processes:
ForceOp 2.8.7 - By RaiSence.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings ForceOp 2.8.7 - By RaiSence.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 16 IoCs
Processes:
wincommon.exesihost.exeWerFault.exepid process 2164 wincommon.exe 3232 sihost.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe 1628 WerFault.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
Processes:
wincommon.exesihost.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2164 wincommon.exe Token: SeDebugPrivilege 3232 sihost.exe Token: SeDebugPrivilege 1628 WerFault.exe -
Suspicious use of WriteProcessMemory ⋅ 23 IoCs
Processes:
ForceOp 2.8.7 - By RaiSence.exeWScript.execmd.exewincommon.exedescription pid process target process PID 1156 wrote to memory of 3408 1156 ForceOp 2.8.7 - By RaiSence.exe WScript.exe PID 1156 wrote to memory of 3408 1156 ForceOp 2.8.7 - By RaiSence.exe WScript.exe PID 1156 wrote to memory of 3408 1156 ForceOp 2.8.7 - By RaiSence.exe WScript.exe PID 1156 wrote to memory of 1032 1156 ForceOp 2.8.7 - By RaiSence.exe WScript.exe PID 1156 wrote to memory of 1032 1156 ForceOp 2.8.7 - By RaiSence.exe WScript.exe PID 1156 wrote to memory of 1032 1156 ForceOp 2.8.7 - By RaiSence.exe WScript.exe PID 3408 wrote to memory of 672 3408 WScript.exe cmd.exe PID 3408 wrote to memory of 672 3408 WScript.exe cmd.exe PID 3408 wrote to memory of 672 3408 WScript.exe cmd.exe PID 672 wrote to memory of 2164 672 cmd.exe wincommon.exe PID 672 wrote to memory of 2164 672 cmd.exe wincommon.exe PID 2164 wrote to memory of 2368 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 2368 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 1084 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 1084 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 3468 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 3468 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 3268 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 3268 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 4024 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 4024 2164 wincommon.exe schtasks.exe PID 2164 wrote to memory of 3232 2164 wincommon.exe sihost.exe PID 2164 wrote to memory of 3232 2164 wincommon.exe sihost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exePID:1156"C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"Modifies registry classSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exePID:3408"C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exePID:672C:\Windows\system32\cmd.exe /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "Suspicious use of WriteProcessMemory
-
C:\intofont\wincommon.exePID:2164"C:\intofont\wincommon.exe"Executes dropped EXEDrops file in Program Files directorySuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exePID:2368"schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\PerfLogs\dllhost.exe'" /rl HIGHEST /fCreates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exePID:1084"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\odt\svchost.exe'" /rl HIGHEST /fCreates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exePID:3468"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\intofont\svchost.exe'" /rl HIGHEST /fCreates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exePID:3268"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\svchost.exe'" /rl HIGHEST /fCreates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exePID:4024"schtasks" /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /fCreates scheduled task(s)
-
C:\Recovery\WindowsRE\sihost.exePID:3232"C:\Recovery\WindowsRE\sihost.exe"Executes dropped EXESuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exePID:1628C:\Windows\system32\WerFault.exe -u -p 3232 -s 1528Suspicious use of NtCreateProcessExOtherParentProcessProgram crashSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exePID:1032"C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\Recovery\WindowsRE\sihost.exe
-
C:\Recovery\WindowsRE\sihost.exe
-
C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe
-
C:\intofont\MOS
-
C:\intofont\msg.vbs
-
C:\intofont\wincommon.exe
-
C:\intofont\wincommon.exe
-
C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat
-
memory/672-19-0x0000000000000000-mapping.dmp
-
memory/1032-15-0x0000000000000000-mapping.dmp
-
memory/1084-28-0x0000000000000000-mapping.dmp
-
memory/1628-58-0x000001E5E28B0000-0x000001E5E28B1000-memory.dmp
-
memory/1628-57-0x000001E5E28B0000-0x000001E5E28B1000-memory.dmp
-
memory/1628-40-0x000001E5E1A40000-0x000001E5E1A41000-memory.dmp
-
memory/1628-39-0x000001E5E1A40000-0x000001E5E1A41000-memory.dmp
-
memory/2164-23-0x00007FFC821F0000-0x00007FFC82BDC000-memory.dmp
-
memory/2164-20-0x0000000000000000-mapping.dmp
-
memory/2164-24-0x00000000007D0000-0x00000000007D1000-memory.dmp
-
memory/2164-26-0x0000000002A30000-0x0000000002A31000-memory.dmp
-
memory/2368-27-0x0000000000000000-mapping.dmp
-
memory/3232-47-0x0000000000000000-mapping.dmp
-
memory/3232-50-0x0000000000000000-mapping.dmp
-
memory/3232-53-0x0000000000000000-mapping.dmp
-
memory/3232-32-0x0000000000000000-mapping.dmp
-
memory/3232-43-0x0000000000000000-mapping.dmp
-
memory/3232-45-0x0000000000000000-mapping.dmp
-
memory/3232-44-0x0000000000000000-mapping.dmp
-
memory/3232-46-0x0000000000000000-mapping.dmp
-
memory/3232-56-0x0000000000000000-mapping.dmp
-
memory/3232-42-0x0000000000000000-mapping.dmp
-
memory/3232-48-0x0000000000000000-mapping.dmp
-
memory/3232-35-0x00007FFC821F0000-0x00007FFC82BDC000-memory.dmp
-
memory/3232-49-0x0000000000000000-mapping.dmp
-
memory/3232-51-0x0000000000000000-mapping.dmp
-
memory/3232-52-0x0000000000000000-mapping.dmp
-
memory/3232-54-0x0000000000000000-mapping.dmp
-
memory/3232-55-0x0000000000000000-mapping.dmp
-
memory/3268-30-0x0000000000000000-mapping.dmp
-
memory/3408-1-0x0000000000000000-mapping.dmp
-
memory/3468-29-0x0000000000000000-mapping.dmp
-
memory/4024-31-0x0000000000000000-mapping.dmp