Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    11-02-2021 07:20

General

  • Target

    Mortgage Description.exe

  • Size

    864KB

  • MD5

    82ff2d4182e8d49b1553cfec4739011c

  • SHA1

    f1605f87331b2c980db3757adcfafb065e318f67

  • SHA256

    b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f

  • SHA512

    85e5e7fab18b096d334d3bf7625e071690f89cd4dffb6c46d30d15f1ec190bfc11c08b8f261d7f59db93fd90e56b4fb84e9efbf99cb779fb6844d4a80772a188

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mortgage Description.exe
    "C:\Users\Admin\AppData\Local\Temp\Mortgage Description.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sheet Proffesional Reader" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sheet Proffesional Reader" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe"
        3⤵
        • Adds Run key to start application
        PID:396
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
        "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1088
      • C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe
        "C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe
          "C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Command and Control

Web Service

1
T1102

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    MD5

    91c9ae9c9a17a9db5e08b120e668c74c

    SHA1

    50770954c1ceb0bb6f1d5d3f2de2a0a065773723

    SHA256

    e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

    SHA512

    ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

  • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    MD5

    91c9ae9c9a17a9db5e08b120e668c74c

    SHA1

    50770954c1ceb0bb6f1d5d3f2de2a0a065773723

    SHA256

    e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

    SHA512

    ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

  • C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe
    MD5

    0e362e7005823d0bec3719b902ed6d62

    SHA1

    590d860b909804349e0cdc2f1662b37bd62f7463

    SHA256

    2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

    SHA512

    518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

  • C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe
    MD5

    0e362e7005823d0bec3719b902ed6d62

    SHA1

    590d860b909804349e0cdc2f1662b37bd62f7463

    SHA256

    2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

    SHA512

    518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

  • C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe
    MD5

    0e362e7005823d0bec3719b902ed6d62

    SHA1

    590d860b909804349e0cdc2f1662b37bd62f7463

    SHA256

    2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

    SHA512

    518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

  • C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.txt
    MD5

    81fe48422a5aca121bffe862ef653c2c

    SHA1

    f9c6c07d496f497436dcda0dc088b67e77a0b1c0

    SHA256

    433cd76ff66b7632a77af2406b308c71cedc12262c7127cd99259bf4a896d8cf

    SHA512

    77524c72262381b6c6378c29951eb62dfe7d63ff43885e603321d399ae4a3c02abcd53f5f284c022c3b055cdebe2936349ad20146ff16f3d93c05fd44f1b2490

  • C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.txt
    MD5

    1a6f667ee6257f8d2812ed66360fe370

    SHA1

    22acfd7c19ac25adb097a25791c55a103db420f7

    SHA256

    0eebf38e1710df30fa2fb8bd3846382e697e2c47884969100defe535067eb956

    SHA512

    1928c333efb9e50dc334aba25e79e36b3e99f8e56e83c6a93a912c5bbf5646c87162feb4c93e4121236c9846dbca3bf0e8abf6ebf8125feb58fefa7ad592db57

  • C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.txt
    MD5

    6ea5574d05de04872c46f08584c1654f

    SHA1

    0e2ca5e9dac7b2343c56e76cfc6cbd3b81ec210e

    SHA256

    6aab8e3dbacd7221571f70b999dfe0afbafdb4b943fc03d904dd8f7a33477447

    SHA512

    7a564ae0689ff0102e55770bd528cf8f21afcfc102f236e1ecb2512d7d7a3a448d3313b4ac34b67f5e76384c3934c6d3ae76ab88ea59d5ce42e59216cb8fd52e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe
    MD5

    82ff2d4182e8d49b1553cfec4739011c

    SHA1

    f1605f87331b2c980db3757adcfafb065e318f67

    SHA256

    b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f

    SHA512

    85e5e7fab18b096d334d3bf7625e071690f89cd4dffb6c46d30d15f1ec190bfc11c08b8f261d7f59db93fd90e56b4fb84e9efbf99cb779fb6844d4a80772a188

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe
    MD5

    82ff2d4182e8d49b1553cfec4739011c

    SHA1

    f1605f87331b2c980db3757adcfafb065e318f67

    SHA256

    b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f

    SHA512

    85e5e7fab18b096d334d3bf7625e071690f89cd4dffb6c46d30d15f1ec190bfc11c08b8f261d7f59db93fd90e56b4fb84e9efbf99cb779fb6844d4a80772a188

  • \Users\Admin\AppData\Local\Temp\InstallUtil.exe
    MD5

    91c9ae9c9a17a9db5e08b120e668c74c

    SHA1

    50770954c1ceb0bb6f1d5d3f2de2a0a065773723

    SHA256

    e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

    SHA512

    ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

  • \Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe
    MD5

    0e362e7005823d0bec3719b902ed6d62

    SHA1

    590d860b909804349e0cdc2f1662b37bd62f7463

    SHA256

    2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

    SHA512

    518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

  • \Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe
    MD5

    0e362e7005823d0bec3719b902ed6d62

    SHA1

    590d860b909804349e0cdc2f1662b37bd62f7463

    SHA256

    2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

    SHA512

    518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe
    MD5

    82ff2d4182e8d49b1553cfec4739011c

    SHA1

    f1605f87331b2c980db3757adcfafb065e318f67

    SHA256

    b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f

    SHA512

    85e5e7fab18b096d334d3bf7625e071690f89cd4dffb6c46d30d15f1ec190bfc11c08b8f261d7f59db93fd90e56b4fb84e9efbf99cb779fb6844d4a80772a188

  • memory/396-10-0x0000000000000000-mapping.dmp
  • memory/1088-27-0x0000000000400000-0x000000000040C000-memory.dmp
    Filesize

    48KB

  • memory/1088-31-0x0000000000400000-0x000000000040C000-memory.dmp
    Filesize

    48KB

  • memory/1088-30-0x00000000736B0000-0x0000000073D9E000-memory.dmp
    Filesize

    6MB

  • memory/1088-28-0x0000000000408D4E-mapping.dmp
  • memory/1088-50-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
    Filesize

    4KB

  • memory/1544-16-0x00000000736B0000-0x0000000073D9E000-memory.dmp
    Filesize

    6MB

  • memory/1544-17-0x0000000000340000-0x0000000000341000-memory.dmp
    Filesize

    4KB

  • memory/1544-24-0x0000000001F30000-0x0000000001F31000-memory.dmp
    Filesize

    4KB

  • memory/1544-23-0x0000000001F20000-0x0000000001F2B000-memory.dmp
    Filesize

    44KB

  • memory/1544-19-0x0000000004520000-0x0000000004521000-memory.dmp
    Filesize

    4KB

  • memory/1544-13-0x0000000000000000-mapping.dmp
  • memory/1620-35-0x0000000000000000-mapping.dmp
  • memory/1620-38-0x00000000736B0000-0x0000000073D9E000-memory.dmp
    Filesize

    6MB

  • memory/1620-39-0x0000000001360000-0x0000000001361000-memory.dmp
    Filesize

    4KB

  • memory/1628-43-0x0000000000000000-mapping.dmp
  • memory/1628-45-0x00000000736B0000-0x0000000073D9E000-memory.dmp
    Filesize

    6MB

  • memory/1648-9-0x0000000000000000-mapping.dmp
  • memory/1944-2-0x00000000742C0000-0x00000000749AE000-memory.dmp
    Filesize

    6MB

  • memory/1944-3-0x0000000000D30000-0x0000000000D31000-memory.dmp
    Filesize

    4KB

  • memory/1944-8-0x00000000004E0000-0x00000000004E1000-memory.dmp
    Filesize

    4KB

  • memory/1944-7-0x00000000009A0000-0x00000000009BE000-memory.dmp
    Filesize

    120KB

  • memory/1944-5-0x0000000002250000-0x0000000002251000-memory.dmp
    Filesize

    4KB

  • memory/1944-11-0x0000000002251000-0x0000000002252000-memory.dmp
    Filesize

    4KB