Analysis

  • max time kernel
    1788s
  • max time network
    1806s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 14:34

General

  • Target

    ForceOp 2.8.7 - By RaiSence.exe

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess ⋅ 1 IoCs
  • Executes dropped EXE ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 1 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 16 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe
    "C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"
    Modifies registry class
    Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"
      Suspicious use of WriteProcessMemory
      PID:3308
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "
        Suspicious use of WriteProcessMemory
        PID:3712
        • C:\intofont\wincommon.exe
          "C:\intofont\wincommon.exe"
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:3876
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
            Creates scheduled task(s)
            PID:1480
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\ProgramData\WindowsHolographicDevices\SpatialStore\svchost.exe'" /rl HIGHEST /f
            Creates scheduled task(s)
            PID:2324
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\intofont\svchost.exe'" /rl HIGHEST /f
            Creates scheduled task(s)
            PID:3576
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
            Creates scheduled task(s)
            PID:2424
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\PerfLogs\Idle.exe'" /rl HIGHEST /f
            Creates scheduled task(s)
            PID:3604
          • C:\PerfLogs\Idle.exe
            "C:\PerfLogs\Idle.exe"
            Executes dropped EXE
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of AdjustPrivilegeToken
            PID:2744
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2744 -s 1784
              Suspicious use of NtCreateProcessExOtherParentProcess
              Program crash
              Suspicious behavior: EnumeratesProcesses
              Suspicious use of AdjustPrivilegeToken
              PID:184
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"
      PID:504

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\PerfLogs\Idle.exe
                      • C:\PerfLogs\Idle.exe
                      • C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe
                      • C:\intofont\MOS
                      • C:\intofont\msg.vbs
                      • C:\intofont\wincommon.exe
                      • C:\intofont\wincommon.exe
                      • C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat
                      • memory/184-58-0x0000022932090000-0x0000022932091000-memory.dmp
                      • memory/184-57-0x0000022932090000-0x0000022932091000-memory.dmp
                      • memory/184-40-0x0000022931220000-0x0000022931221000-memory.dmp
                      • memory/184-39-0x0000022931220000-0x0000022931221000-memory.dmp
                      • memory/504-14-0x0000000000000000-mapping.dmp
                      • memory/1480-27-0x0000000000000000-mapping.dmp
                      • memory/2324-28-0x0000000000000000-mapping.dmp
                      • memory/2424-30-0x0000000000000000-mapping.dmp
                      • memory/2744-48-0x0000000000000000-mapping.dmp
                      • memory/2744-55-0x0000000000000000-mapping.dmp
                      • memory/2744-32-0x0000000000000000-mapping.dmp
                      • memory/2744-52-0x0000000000000000-mapping.dmp
                      • memory/2744-51-0x0000000000000000-mapping.dmp
                      • memory/2744-35-0x00007FF99FA60000-0x00007FF9A044C000-memory.dmp
                      • memory/2744-56-0x0000000000000000-mapping.dmp
                      • memory/2744-54-0x0000000000000000-mapping.dmp
                      • memory/2744-42-0x0000000000000000-mapping.dmp
                      • memory/2744-44-0x0000000000000000-mapping.dmp
                      • memory/2744-43-0x0000000000000000-mapping.dmp
                      • memory/2744-45-0x0000000000000000-mapping.dmp
                      • memory/2744-47-0x0000000000000000-mapping.dmp
                      • memory/2744-46-0x0000000000000000-mapping.dmp
                      • memory/2744-53-0x0000000000000000-mapping.dmp
                      • memory/2744-50-0x0000000000000000-mapping.dmp
                      • memory/2744-49-0x0000000000000000-mapping.dmp
                      • memory/3308-1-0x0000000000000000-mapping.dmp
                      • memory/3576-29-0x0000000000000000-mapping.dmp
                      • memory/3604-31-0x0000000000000000-mapping.dmp
                      • memory/3712-19-0x0000000000000000-mapping.dmp
                      • memory/3876-23-0x00007FF99FA60000-0x00007FF9A044C000-memory.dmp
                      • memory/3876-24-0x0000000000A00000-0x0000000000A01000-memory.dmp
                      • memory/3876-26-0x000000001C430000-0x000000001C431000-memory.dmp
                      • memory/3876-20-0x0000000000000000-mapping.dmp