Resubmissions
17-01-2021 17:20
210117-42l4186m4a 1017-01-2021 17:16
210117-436yb29wwa 1011-01-2021 07:41
210111-s6ytr1ebc2 10Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 17:20
General
-
Target
6275a839b5071bf445539c8652d2b13b.exe
-
Size
1.0MB
-
MD5
6275a839b5071bf445539c8652d2b13b
-
SHA1
1e0946ea29e3eca33384ccab5a627d778a6e612d
-
SHA256
f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718
-
SHA512
f31006c16dc31548283a4434ee4e13e878a24d10c1963d6b81083862a8cd544004612886e77774e3072481fee0411665d6db6ca8d5e25b9e8e72e7252603d677
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops desktop.ini file(s) 4 IoCs
-
Drops file in Program Files directory 15251 IoCs
-
Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Control Panel 1 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 560 IoCs
-
Suspicious use of AdjustPrivilegeToken 56 IoCs
-
Suspicious use of FindShellTrayWindow 97 IoCs
-
Suspicious use of SendNotifyMessage 97 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6275a839b5071bf445539c8652d2b13b.exe"C:\Users\Admin\AppData\Local\Temp\6275a839b5071bf445539c8652d2b13b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ieinstal.exeMD5
3c8ef0faf114b5d5f007c201b3f2a1a4
SHA1dc979c1d38c5714313d62ec750c05ba59b085f01
SHA25602480db613c12b9e852a2c2f37ec6fb0b1d1612dbe339e3670d60f20c829761e
SHA5124b7408bd17e51b32188a654ea4edfd01c7f2cbd80d5c00e3cb7195e851e6419161927529727861f4f4e79cae2ce25fe33bcb5950f34a4b4012799d8247c36b54
-
C:\Users\Admin\AppData\Local\ieinstal.exeMD5
3c8ef0faf114b5d5f007c201b3f2a1a4
SHA1dc979c1d38c5714313d62ec750c05ba59b085f01
SHA25602480db613c12b9e852a2c2f37ec6fb0b1d1612dbe339e3670d60f20c829761e
SHA5124b7408bd17e51b32188a654ea4edfd01c7f2cbd80d5c00e3cb7195e851e6419161927529727861f4f4e79cae2ce25fe33bcb5950f34a4b4012799d8247c36b54
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ieinstal.exeMD5
3c8ef0faf114b5d5f007c201b3f2a1a4
SHA1dc979c1d38c5714313d62ec750c05ba59b085f01
SHA25602480db613c12b9e852a2c2f37ec6fb0b1d1612dbe339e3670d60f20c829761e
SHA5124b7408bd17e51b32188a654ea4edfd01c7f2cbd80d5c00e3cb7195e851e6419161927529727861f4f4e79cae2ce25fe33bcb5950f34a4b4012799d8247c36b54
-
C:\Users\Admin\ldfwV.urlMD5
2f01e366c85c9e3acec634da03a36277
SHA138c5c7a7d7daedeae0959b7a461fdc87556f9379
SHA25621c20b571b1379ce9ad0b405116080876510a9d29044267489f89eb73f5f2fa9
SHA51226ee50b3feb56ab2ceaea82454ef22907778aa554b21f472394511ccc10f26d65c7c0e245aad35eb28a0d55d98edf802c2ec2a8f32801fcdf09478bcd9ae6ed6
-
memory/772-20-0x0000000000000000-mapping.dmp
-
memory/1100-19-0x0000000000000000-mapping.dmp
-
memory/1384-14-0x0000000000000000-mapping.dmp
-
memory/1852-15-0x0000000000000000-mapping.dmp
-
memory/2340-17-0x0000000000000000-mapping.dmp
-
memory/3292-18-0x0000000000000000-mapping.dmp
-
memory/3936-16-0x0000000000000000-mapping.dmp
-
memory/3976-2-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/4044-13-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4044-12-0x0000000010530000-0x0000000010545000-memory.dmpFilesize
84KB
-
memory/4044-7-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/4044-5-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/4044-4-0x0000000000000000-mapping.dmp
-
memory/4044-3-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB