Analysis
-
max time kernel
126s -
max time network
127s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-02-2021 18:57
Static task
static1
Behavioral task
behavioral1
Sample
df73c80c3b297b161dd6681a354b9392.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
df73c80c3b297b161dd6681a354b9392.exe
Resource
win10v20201028
General
-
Target
df73c80c3b297b161dd6681a354b9392.exe
-
Size
1.9MB
-
MD5
df73c80c3b297b161dd6681a354b9392
-
SHA1
3db99991178812a5d4f5f7468151055884109699
-
SHA256
3e43a04b037b6e092c352fcf85eef535cf036ee8a4b7100cb15f7343ab2b097f
-
SHA512
58d611a2d0e328a36239e04bcf145e51076b9bb7ef113db732812ddda76d71064acab13ae1abc7264f8eb9ce60118f7bc94ef9c484327cfda33a59e16394a8e6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
multitimer.exemultitimer.exepid process 1112 multitimer.exe 1664 multitimer.exe -
Drops file in Windows directory 2 IoCs
Processes:
multitimer.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
df73c80c3b297b161dd6681a354b9392.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 df73c80c3b297b161dd6681a354b9392.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde df73c80c3b297b161dd6681a354b9392.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
df73c80c3b297b161dd6681a354b9392.exedescription pid process Token: SeDebugPrivilege 1812 df73c80c3b297b161dd6681a354b9392.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
df73c80c3b297b161dd6681a354b9392.exemultitimer.exedescription pid process target process PID 1812 wrote to memory of 1112 1812 df73c80c3b297b161dd6681a354b9392.exe multitimer.exe PID 1812 wrote to memory of 1112 1812 df73c80c3b297b161dd6681a354b9392.exe multitimer.exe PID 1812 wrote to memory of 1112 1812 df73c80c3b297b161dd6681a354b9392.exe multitimer.exe PID 1112 wrote to memory of 1664 1112 multitimer.exe multitimer.exe PID 1112 wrote to memory of 1664 1112 multitimer.exe multitimer.exe PID 1112 wrote to memory of 1664 1112 multitimer.exe multitimer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df73c80c3b297b161dd6681a354b9392.exe"C:\Users\Admin\AppData\Local\Temp\df73c80c3b297b161dd6681a354b9392.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\07KSSZRRUY\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\07KSSZRRUY\multitimer.exe" 0 30601988b56f78c9.53290271 0 1022⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\07KSSZRRUY\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\07KSSZRRUY\multitimer.exe" 13⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\07KSSZRRUY\multitimer.exeMD5
ccf73cd3ed0ea55bd26d6b297cd0aa68
SHA186c4d85647e6b5bde8a5b65b31d57d663b9e3a10
SHA25662779784407a8ee38c89e5bdfcbd2290b5f5d6f24e7db68da3a04382b425699f
SHA512fc923af24202cce4333616b2fe0ad9e96a3fce0d95f2cc3698bc9b101d142ab64049726a66f9b32eb7a1c05996213e88ab05bfffc7094deffd4f201dc88c1583
-
C:\Users\Admin\AppData\Local\Temp\07KSSZRRUY\multitimer.exeMD5
ccf73cd3ed0ea55bd26d6b297cd0aa68
SHA186c4d85647e6b5bde8a5b65b31d57d663b9e3a10
SHA25662779784407a8ee38c89e5bdfcbd2290b5f5d6f24e7db68da3a04382b425699f
SHA512fc923af24202cce4333616b2fe0ad9e96a3fce0d95f2cc3698bc9b101d142ab64049726a66f9b32eb7a1c05996213e88ab05bfffc7094deffd4f201dc88c1583
-
C:\Users\Admin\AppData\Local\Temp\07KSSZRRUY\multitimer.exeMD5
ccf73cd3ed0ea55bd26d6b297cd0aa68
SHA186c4d85647e6b5bde8a5b65b31d57d663b9e3a10
SHA25662779784407a8ee38c89e5bdfcbd2290b5f5d6f24e7db68da3a04382b425699f
SHA512fc923af24202cce4333616b2fe0ad9e96a3fce0d95f2cc3698bc9b101d142ab64049726a66f9b32eb7a1c05996213e88ab05bfffc7094deffd4f201dc88c1583
-
C:\Users\Admin\AppData\Local\Temp\07KSSZRRUY\multitimer.exe.configMD5
3f1498c07d8713fe5c315db15a2a2cf3
SHA1ef5f42fd21f6e72bdc74794f2496884d9c40bbfb
SHA25652ca39624f8fd70bc441d055712f115856bc67b37efb860d654e4a8909106dc0
SHA512cb32ce5ef72548d1b0d27f3f254f4b67b23a0b662d0ef7ae12f9e3ef1b0a917b098368b434caf54751c02c0f930e92cffd384f105d8d79ee725df4d97a559a3d
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cchMD5
bfa6e65e9a03b4f4c78dd0ff7823f916
SHA18b78bfbfe3f7bbe7e649b42ec2d0974996b0eae2
SHA256857c40b901183c452ff788db367f28a2a4726d89c32bd75f59f6e30490defe5f
SHA5123c270ca6f76fa54820a0fe010ac4246ffd5705e168502456eb1fcafc34f5a095fcb22e2607e9e39fa0ce48f0656d08db42bb6e338e9abe780ac4bf4de86a6b7b
-
memory/1112-11-0x00000000022E0000-0x00000000022E2000-memory.dmpFilesize
8KB
-
memory/1112-9-0x000007FEEE650000-0x000007FEEEFED000-memory.dmpFilesize
9.6MB
-
memory/1112-10-0x000007FEEE650000-0x000007FEEEFED000-memory.dmpFilesize
9.6MB
-
memory/1112-6-0x0000000000000000-mapping.dmp
-
memory/1664-13-0x0000000000000000-mapping.dmp
-
memory/1664-15-0x000007FEEE650000-0x000007FEEEFED000-memory.dmpFilesize
9.6MB
-
memory/1664-16-0x000007FEEE650000-0x000007FEEEFED000-memory.dmpFilesize
9.6MB
-
memory/1664-18-0x00000000021E0000-0x00000000021E2000-memory.dmpFilesize
8KB
-
memory/1812-2-0x000007FEF5990000-0x000007FEF637C000-memory.dmpFilesize
9.9MB
-
memory/1812-5-0x000000001B060000-0x000000001B062000-memory.dmpFilesize
8KB
-
memory/1812-3-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB