Overview
overview
10Static
static
8122de0842b...0d.exe
windows7_x64
6122de0842b...0d.exe
windows10_x64
621837bd6a7...27.exe
windows7_x64
1021837bd6a7...27.exe
windows10_x64
1030131519d2...fc.exe
windows7_x64
130131519d2...fc.exe
windows10_x64
53be39aebff...7a.exe
windows7_x64
83be39aebff...7a.exe
windows10_x64
85514456013...b8.exe
windows7_x64
105514456013...b8.exe
windows10_x64
1061d44476de...3e.exe
windows7_x64
961d44476de...3e.exe
windows10_x64
96ee50d84fd...c3.exe
windows7_x64
86ee50d84fd...c3.exe
windows10_x64
882c04fda59...b5.exe
windows7_x64
182c04fda59...b5.exe
windows10_x64
1a101cc8e9f...75.exe
windows7_x64
8a101cc8e9f...75.exe
windows10_x64
8b5674726f7...b0.exe
windows7_x64
6b5674726f7...b0.exe
windows10_x64
8c939f36967...08.exe
windows7_x64
8c939f36967...08.exe
windows10_x64
8de36168cfc...49.exe
windows7_x64
10de36168cfc...49.exe
windows10_x64
10eb9775066c...4d.exe
windows7_x64
10eb9775066c...4d.exe
windows10_x64
10Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-01-2021 02:37
Behavioral task
behavioral1
Sample
122de0842b4df547c9bddfb0b594a1b8f8b55da501c6f35b038153981cf1870d.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
122de0842b4df547c9bddfb0b594a1b8f8b55da501c6f35b038153981cf1870d.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
21837bd6a795e92f326fe1a26523411408c5e8ad38054353c55ffc514e72b927.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
21837bd6a795e92f326fe1a26523411408c5e8ad38054353c55ffc514e72b927.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
30131519d29744c302b7cc68898c5238358a75a0c01d398b3df894896620cbfc.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
30131519d29744c302b7cc68898c5238358a75a0c01d398b3df894896620cbfc.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
3be39aebffed61e79f7bd2405d3e2722a1cf388a820b819ff76c1c1a132fd37a.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
3be39aebffed61e79f7bd2405d3e2722a1cf388a820b819ff76c1c1a132fd37a.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
61d44476deb3368a54bb936e56a7aadb9226e78b88f67f939ed1cf0932f3263e.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
61d44476deb3368a54bb936e56a7aadb9226e78b88f67f939ed1cf0932f3263e.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
Resource
win7v20201028
Behavioral task
behavioral14
Sample
6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
82c04fda5985f51abe024bfda867bc3aaa0ffd26a500cd7cc40f8238df9b1eb5.exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
82c04fda5985f51abe024bfda867bc3aaa0ffd26a500cd7cc40f8238df9b1eb5.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
a101cc8e9f1eac76c6fc006e9e746b59dc94b73e1358803ad94d70a0938d3a75.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
a101cc8e9f1eac76c6fc006e9e746b59dc94b73e1358803ad94d70a0938d3a75.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
b5674726f7f51d5880211f8ca8aea069bc6fc758794748117db27b8df25a12b0.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
b5674726f7f51d5880211f8ca8aea069bc6fc758794748117db27b8df25a12b0.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
eb9775066c55310131db50ee2606fb66353e4c694d5713abaddd2293806ac34d.exe
Resource
win7v20201028
General
-
Target
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral21/memory/2040-4-0x0000000010000000-0x0000000010108000-memory.dmp upx behavioral21/memory/2040-7-0x0000000010000000-0x0000000010108000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\DDR = "C:\\Users\\Admin\\AppData\\Roaming\\LFS.exe" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exedescription pid process target process PID 1752 set thread context of 2040 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 set thread context of 1324 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exedescription pid process target process PID 1752 wrote to memory of 2040 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 2040 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 2040 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 2040 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 2040 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 2040 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 1324 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 1324 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 1324 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 1324 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 1324 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe PID 1752 wrote to memory of 1324 1752 c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe"C:\Users\Admin\AppData\Local\Temp\c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1324-9-0x00000000100AB290-mapping.dmp
-
memory/1752-2-0x0000000075EB1000-0x0000000075EB3000-memory.dmpFilesize
8KB
-
memory/1752-3-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2040-4-0x0000000010000000-0x0000000010108000-memory.dmpFilesize
1.0MB
-
memory/2040-5-0x00000000100AB290-mapping.dmp
-
memory/2040-7-0x0000000010000000-0x0000000010108000-memory.dmpFilesize
1.0MB