4a9006cf3b6e40360af21fbc2c9c419a58212f9fc06cb2a534240790a2e6dbac

Analysis

max time kernel
83s
max time network
96s
platform
windows7_x64
resource
win7v20201028
submitted
26-01-2021 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2044 svchost.exe

pid	process
2044	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\svchost.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Drops file in Windows directory 7 IoCs

Processes:

6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe

description	ioc	process
File opened for modification	C:\Windows\msvcr100.dll	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
File created	C:\Windows\svchost.exe	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
File opened for modification	C:\Windows\svchost.exe	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_259264910	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
File created	C:\Windows\autorun.bat	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
File opened for modification	C:\Windows\autorun.bat	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
File created	C:\Windows\msvcr100.dll	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1888 reg.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: 35 2044 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

2044 svchost.exe

pid	process
1888	reg.exe

description	pid	process
Token: 35	2044	svchost.exe

pid	process
2044	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.execmd.exesvchost.exe

description	pid	process	target process
PID 776 wrote to memory of 1404	776	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe	cmd.exe
PID 776 wrote to memory of 1404	776	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe	cmd.exe
PID 776 wrote to memory of 1404	776	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe	cmd.exe
PID 776 wrote to memory of 1404	776	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe	cmd.exe
PID 776 wrote to memory of 2044	776	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe	svchost.exe
PID 776 wrote to memory of 2044	776	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe	svchost.exe
PID 776 wrote to memory of 2044	776	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe	svchost.exe
PID 776 wrote to memory of 2044	776	6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe	svchost.exe
PID 1404 wrote to memory of 1888	1404	cmd.exe	reg.exe
PID 1404 wrote to memory of 1888	1404	cmd.exe	reg.exe
PID 1404 wrote to memory of 1888	1404	cmd.exe	reg.exe
PID 1404 wrote to memory of 1888	1404	cmd.exe	reg.exe
PID 2044 wrote to memory of 1136	2044	svchost.exe	cmd.exe
PID 2044 wrote to memory of 1136	2044	svchost.exe	cmd.exe
PID 2044 wrote to memory of 1136	2044	svchost.exe	cmd.exe
PID 2044 wrote to memory of 1136	2044	svchost.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
"C:\Users\Admin\AppData\Local\Temp\6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\autorun.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d "C:\Windows\svchost.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1888

C:\Windows\svchost.exe
"C:\Windows\svchost.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
3⤵
PID:1136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MSVCR100.dll
MD5
108df274f48297bcc8cbb016a8361da8

SHA1
ebd4eb2e60c814c28f0936c4da73105a0fcb3cbd

SHA256
99c244033d3847b06eec6a38a5e5ae04de62dd17230cc8ba060a32589b664d1b

SHA512
a1359362a3fdd1b2a708bcabae2083914252af8a19b3d175813656bf8bf37f024b5842fd28bc76dd153239aa79574bfe601c17c17c689d5211607e333c332a1e

Download Submit
C:\Windows\autorun.bat
MD5
759370961d49e357e9e108985a114eeb

SHA1
8c148204735582da434dfd2cd5cb8cb3d76b7b9f

SHA256
fcdaf0305c1cad057cfe6bc629f0712699200e802405a2783a343d3d79a35b8e

SHA512
4ae45e31b205efac81489174ddb2e91e8b6daf1564a843b9e508b402650c018d22784ab9f4ae097525bd56d42c19ffb8357aeb59b085215b787f8b9449fb4f82

Download Submit
C:\Windows\svchost.exe
MD5
76abbf632915be9a548f2c2f9fea1278

SHA1
5ca139b31cdac84225fa1b063a1b9cbb21fbc3f5

SHA256
e91a3b6db318abf8dc60da4500b7a4f6578fe666241d32dce96e258d19652c24

SHA512
61090ffb2b655eb0d4316c100c2865a5a08e6bd4d099b7ac683c7eaf12a9de34a19da91c8b1f61d4d4d34da38c42c66c59c0bcbdeba7ce19b2d6a1c2021d980c

Download Submit
C:\Windows\svchost.exe
MD5
76abbf632915be9a548f2c2f9fea1278

SHA1
5ca139b31cdac84225fa1b063a1b9cbb21fbc3f5

SHA256
e91a3b6db318abf8dc60da4500b7a4f6578fe666241d32dce96e258d19652c24

SHA512
61090ffb2b655eb0d4316c100c2865a5a08e6bd4d099b7ac683c7eaf12a9de34a19da91c8b1f61d4d4d34da38c42c66c59c0bcbdeba7ce19b2d6a1c2021d980c

Download Submit
memory/776-2-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1136-13-0x0000000000000000-mapping.dmp

Download
memory/1404-3-0x0000000000000000-mapping.dmp

Download
memory/1888-8-0x0000000000000000-mapping.dmp

Download
memory/2044-4-0x0000000000000000-mapping.dmp

Download
memory/2044-10-0x00000000029B0000-0x00000000029C1000-memory.dmp

Filesize
68KB

Download
memory/2044-11-0x000000001E000000-0x000000001E2A9000-memory.dmp

Filesize
2.7MB

Download