Overview
overview
10Static
static
8122de0842b...0d.exe
windows7_x64
6122de0842b...0d.exe
windows10_x64
621837bd6a7...27.exe
windows7_x64
1021837bd6a7...27.exe
windows10_x64
1030131519d2...fc.exe
windows7_x64
130131519d2...fc.exe
windows10_x64
53be39aebff...7a.exe
windows7_x64
83be39aebff...7a.exe
windows10_x64
85514456013...b8.exe
windows7_x64
105514456013...b8.exe
windows10_x64
1061d44476de...3e.exe
windows7_x64
961d44476de...3e.exe
windows10_x64
96ee50d84fd...c3.exe
windows7_x64
86ee50d84fd...c3.exe
windows10_x64
882c04fda59...b5.exe
windows7_x64
182c04fda59...b5.exe
windows10_x64
1a101cc8e9f...75.exe
windows7_x64
8a101cc8e9f...75.exe
windows10_x64
8b5674726f7...b0.exe
windows7_x64
6b5674726f7...b0.exe
windows10_x64
8c939f36967...08.exe
windows7_x64
8c939f36967...08.exe
windows10_x64
8de36168cfc...49.exe
windows7_x64
10de36168cfc...49.exe
windows10_x64
10eb9775066c...4d.exe
windows7_x64
10eb9775066c...4d.exe
windows10_x64
10Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-01-2021 02:37
Behavioral task
behavioral1
Sample
122de0842b4df547c9bddfb0b594a1b8f8b55da501c6f35b038153981cf1870d.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
122de0842b4df547c9bddfb0b594a1b8f8b55da501c6f35b038153981cf1870d.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
21837bd6a795e92f326fe1a26523411408c5e8ad38054353c55ffc514e72b927.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
21837bd6a795e92f326fe1a26523411408c5e8ad38054353c55ffc514e72b927.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
30131519d29744c302b7cc68898c5238358a75a0c01d398b3df894896620cbfc.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
30131519d29744c302b7cc68898c5238358a75a0c01d398b3df894896620cbfc.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
3be39aebffed61e79f7bd2405d3e2722a1cf388a820b819ff76c1c1a132fd37a.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
3be39aebffed61e79f7bd2405d3e2722a1cf388a820b819ff76c1c1a132fd37a.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
61d44476deb3368a54bb936e56a7aadb9226e78b88f67f939ed1cf0932f3263e.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
61d44476deb3368a54bb936e56a7aadb9226e78b88f67f939ed1cf0932f3263e.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
Resource
win7v20201028
Behavioral task
behavioral14
Sample
6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
82c04fda5985f51abe024bfda867bc3aaa0ffd26a500cd7cc40f8238df9b1eb5.exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
82c04fda5985f51abe024bfda867bc3aaa0ffd26a500cd7cc40f8238df9b1eb5.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
a101cc8e9f1eac76c6fc006e9e746b59dc94b73e1358803ad94d70a0938d3a75.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
a101cc8e9f1eac76c6fc006e9e746b59dc94b73e1358803ad94d70a0938d3a75.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
b5674726f7f51d5880211f8ca8aea069bc6fc758794748117db27b8df25a12b0.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
b5674726f7f51d5880211f8ca8aea069bc6fc758794748117db27b8df25a12b0.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
eb9775066c55310131db50ee2606fb66353e4c694d5713abaddd2293806ac34d.exe
Resource
win7v20201028
General
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WINWORD.exepid process 1516 WINWORD.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exepid process 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\FlashPlayer Update = "C:\\Users\\Admin\\AppData\\Roaming\\divandshare.exe" de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe -
Processes:
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe -
Drops file in System32 directory 1 IoCs
Processes:
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exedescription ioc process File opened for modification C:\Windows\SysWOW64\WINWORD.exe de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.execmd.execmd.exedescription pid process target process PID 792 wrote to memory of 2044 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe cmd.exe PID 792 wrote to memory of 2044 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe cmd.exe PID 792 wrote to memory of 2044 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe cmd.exe PID 792 wrote to memory of 2044 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe cmd.exe PID 792 wrote to memory of 1104 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe cmd.exe PID 792 wrote to memory of 1104 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe cmd.exe PID 792 wrote to memory of 1104 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe cmd.exe PID 792 wrote to memory of 1104 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe cmd.exe PID 2044 wrote to memory of 1976 2044 cmd.exe cmd.exe PID 2044 wrote to memory of 1976 2044 cmd.exe cmd.exe PID 2044 wrote to memory of 1976 2044 cmd.exe cmd.exe PID 2044 wrote to memory of 1976 2044 cmd.exe cmd.exe PID 1104 wrote to memory of 1800 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1800 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1800 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1800 1104 cmd.exe netsh.exe PID 2044 wrote to memory of 1224 2044 cmd.exe icacls.exe PID 2044 wrote to memory of 1224 2044 cmd.exe icacls.exe PID 2044 wrote to memory of 1224 2044 cmd.exe icacls.exe PID 2044 wrote to memory of 1224 2044 cmd.exe icacls.exe PID 1104 wrote to memory of 1736 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1736 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1736 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1736 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1732 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1732 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1732 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 1732 1104 cmd.exe netsh.exe PID 792 wrote to memory of 1516 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe WINWORD.exe PID 792 wrote to memory of 1516 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe WINWORD.exe PID 792 wrote to memory of 1516 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe WINWORD.exe PID 792 wrote to memory of 1516 792 de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe WINWORD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe"C:\Users\Admin\AppData\Local\Temp\de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ECHO Y|icacls C:\Users\Admin\AppData\Roaming/divandshare.exe /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO Y"3⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Users\Admin\AppData\Roaming/divandshare.exe /grant administrators:F3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k (netsh advfirewall firewall delete rule name="TCP/UDP Control" | netsh advfirewall firewall add rule name="TCP/UDP Control" dir=in action=allow protocol=TCP localport=1930 | netsh advfirewall firewall add rule name="TCP/UDP Control" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe") & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="TCP/UDP Control"3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="TCP/UDP Control" dir=in action=allow protocol=TCP localport=19303⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="TCP/UDP Control" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe"3⤵
-
C:\Windows\SysWOW64\WINWORD.exe"C:\Windows\System32\WINWORD.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\divandshare.exeMD5
ab7a640c6b203e4675a45a08eb96a998
SHA189b5ba11a035ef784854c94df020d283b6802b82
SHA256de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149
SHA5120168c99f2a7a71f5bd8f629083288723f0e7997423e787af46828fabd3b887395ad31539e0623e6b0bbcd3dde926c7e4a68f78dcec088cc5e3ae227a34eadf55
-
C:\Windows\SysWOW64\WINWORD.exeMD5
f695125cf286818943bc338deb796132
SHA1e6de390e98c0c854a3b58950e00baa2abada9090
SHA256a0d4439f9806edaf86751e0cffe63c762034080cddb7c9b6e7eaed74b0e79120
SHA512bcfe9a3fdec4239133527fabf6a9cccf77c7fe0dee76a4dbf9c8c88b24154871c96aec5c7a954e2168f03594971d73a6c7a0ef074f0be65304aeb5eb455b60ac
-
C:\Windows\SysWOW64\WINWORD.exeMD5
f695125cf286818943bc338deb796132
SHA1e6de390e98c0c854a3b58950e00baa2abada9090
SHA256a0d4439f9806edaf86751e0cffe63c762034080cddb7c9b6e7eaed74b0e79120
SHA512bcfe9a3fdec4239133527fabf6a9cccf77c7fe0dee76a4dbf9c8c88b24154871c96aec5c7a954e2168f03594971d73a6c7a0ef074f0be65304aeb5eb455b60ac
-
\Windows\SysWOW64\WINWORD.exeMD5
f695125cf286818943bc338deb796132
SHA1e6de390e98c0c854a3b58950e00baa2abada9090
SHA256a0d4439f9806edaf86751e0cffe63c762034080cddb7c9b6e7eaed74b0e79120
SHA512bcfe9a3fdec4239133527fabf6a9cccf77c7fe0dee76a4dbf9c8c88b24154871c96aec5c7a954e2168f03594971d73a6c7a0ef074f0be65304aeb5eb455b60ac
-
\Windows\SysWOW64\WINWORD.exeMD5
f695125cf286818943bc338deb796132
SHA1e6de390e98c0c854a3b58950e00baa2abada9090
SHA256a0d4439f9806edaf86751e0cffe63c762034080cddb7c9b6e7eaed74b0e79120
SHA512bcfe9a3fdec4239133527fabf6a9cccf77c7fe0dee76a4dbf9c8c88b24154871c96aec5c7a954e2168f03594971d73a6c7a0ef074f0be65304aeb5eb455b60ac
-
memory/792-3-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/792-2-0x00000000765E1000-0x00000000765E3000-memory.dmpFilesize
8KB
-
memory/1104-5-0x0000000000000000-mapping.dmp
-
memory/1224-8-0x0000000000000000-mapping.dmp
-
memory/1516-17-0x0000000000000000-mapping.dmp
-
memory/1516-22-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/1716-21-0x000007FEF63D0000-0x000007FEF664A000-memory.dmpFilesize
2.5MB
-
memory/1732-10-0x0000000000000000-mapping.dmp
-
memory/1736-9-0x0000000000000000-mapping.dmp
-
memory/1800-7-0x0000000000000000-mapping.dmp
-
memory/1976-6-0x0000000000000000-mapping.dmp
-
memory/2044-4-0x0000000000000000-mapping.dmp