Analysis
-
max time kernel
37s -
max time network
64s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 06:54
Static task
static1
Behavioral task
behavioral1
Sample
believehot23 cccc.exe
Resource
win7v20201028
General
-
Target
believehot23 cccc.exe
-
Size
21KB
-
MD5
60c08a798dfec76af8ebab5b019faffc
-
SHA1
33ae9c59bfe576e3ff1318d764fdbda05dfa26e2
-
SHA256
c15a76e6023a05abd0237937cad3353bc104e97ee19d2fbcd475e1721b330c50
-
SHA512
3de451f1903ff7d5cbe11c557d37b74852dbad3d59648b56f4dc447875859dd57d8391e0b9fe98a3c83a9e130c2089dabead0c15c5d6dcce4e3a47f944142898
Malware Config
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exe Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeAdvancedRun.exeAdvancedRun.exepid process 2068 AdvancedRun.exe 2400 AdvancedRun.exe 3248 AdvancedRun.exe 740 AdvancedRun.exe -
Processes:
believehot23 cccc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths believehot23 cccc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions believehot23 cccc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection believehot23 cccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" believehot23 cccc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet believehot23 cccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" believehot23 cccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" believehot23 cccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\believehot23 cccc.exe = "0" believehot23 cccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" believehot23 cccc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features believehot23 cccc.exe -
Processes:
believehot23 cccc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA believehot23 cccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" believehot23 cccc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exeAdvancedRun.exeAdvancedRun.exepid process 2068 AdvancedRun.exe 2068 AdvancedRun.exe 2068 AdvancedRun.exe 2068 AdvancedRun.exe 2400 AdvancedRun.exe 2400 AdvancedRun.exe 2400 AdvancedRun.exe 2400 AdvancedRun.exe 3808 powershell.exe 1260 powershell.exe 3248 AdvancedRun.exe 3248 AdvancedRun.exe 3248 AdvancedRun.exe 3248 AdvancedRun.exe 740 AdvancedRun.exe 740 AdvancedRun.exe 1260 powershell.exe 740 AdvancedRun.exe 740 AdvancedRun.exe 3808 powershell.exe 1260 powershell.exe 3808 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
believehot23 cccc.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exeAdvancedRun.exeAdvancedRun.exedescription pid process Token: SeDebugPrivilege 1456 believehot23 cccc.exe Token: SeDebugPrivilege 2068 AdvancedRun.exe Token: SeImpersonatePrivilege 2068 AdvancedRun.exe Token: SeDebugPrivilege 2400 AdvancedRun.exe Token: SeImpersonatePrivilege 2400 AdvancedRun.exe Token: SeDebugPrivilege 1260 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeDebugPrivilege 3248 AdvancedRun.exe Token: SeImpersonatePrivilege 3248 AdvancedRun.exe Token: SeDebugPrivilege 740 AdvancedRun.exe Token: SeImpersonatePrivilege 740 AdvancedRun.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
believehot23 cccc.exeAdvancedRun.exeAdvancedRun.exedescription pid process target process PID 1456 wrote to memory of 2068 1456 believehot23 cccc.exe AdvancedRun.exe PID 1456 wrote to memory of 2068 1456 believehot23 cccc.exe AdvancedRun.exe PID 1456 wrote to memory of 2068 1456 believehot23 cccc.exe AdvancedRun.exe PID 2068 wrote to memory of 2400 2068 AdvancedRun.exe AdvancedRun.exe PID 2068 wrote to memory of 2400 2068 AdvancedRun.exe AdvancedRun.exe PID 2068 wrote to memory of 2400 2068 AdvancedRun.exe AdvancedRun.exe PID 1456 wrote to memory of 3808 1456 believehot23 cccc.exe powershell.exe PID 1456 wrote to memory of 3808 1456 believehot23 cccc.exe powershell.exe PID 1456 wrote to memory of 3808 1456 believehot23 cccc.exe powershell.exe PID 1456 wrote to memory of 1260 1456 believehot23 cccc.exe powershell.exe PID 1456 wrote to memory of 1260 1456 believehot23 cccc.exe powershell.exe PID 1456 wrote to memory of 1260 1456 believehot23 cccc.exe powershell.exe PID 1456 wrote to memory of 3248 1456 believehot23 cccc.exe AdvancedRun.exe PID 1456 wrote to memory of 3248 1456 believehot23 cccc.exe AdvancedRun.exe PID 1456 wrote to memory of 3248 1456 believehot23 cccc.exe AdvancedRun.exe PID 3248 wrote to memory of 740 3248 AdvancedRun.exe AdvancedRun.exe PID 3248 wrote to memory of 740 3248 AdvancedRun.exe AdvancedRun.exe PID 3248 wrote to memory of 740 3248 AdvancedRun.exe AdvancedRun.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
believehot23 cccc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" believehot23 cccc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\believehot23 cccc.exe"C:\Users\Admin\AppData\Local\Temp\believehot23 cccc.exe"1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exe" /SpecialRun 4101d8 20683⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\believehot23 cccc.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\believehot23 cccc.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\believehot23 cccc.exe" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exe" /SpecialRun 4101d8 32483⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
459dd51340a72bae5c0b0db463c6c59f
SHA1b095babebfb678a2c0ba99caadf2873b0a53cc5c
SHA256c81de6da49696703e1030fcb40a33781a6673dea422764a304a4198a39441630
SHA5129579d80b286918cef723901004e2bda281e9815089220f8bb640e4a821e2969e25232c792b392e55c5307fdc10a2dfd618213d08e7e54fac2211d94db43078a7
-
C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\b520a070-5380-4668-b7a4-df81ce446a74\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\ce0b5982-4ffd-432f-82ce-54db195ebc4a\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/740-41-0x0000000000000000-mapping.dmp
-
memory/1260-47-0x0000000008540000-0x0000000008541000-memory.dmpFilesize
4KB
-
memory/1260-45-0x0000000008240000-0x0000000008241000-memory.dmpFilesize
4KB
-
memory/1260-28-0x0000000003172000-0x0000000003173000-memory.dmpFilesize
4KB
-
memory/1260-51-0x00000000094F0000-0x0000000009523000-memory.dmpFilesize
204KB
-
memory/1260-18-0x0000000000000000-mapping.dmp
-
memory/1260-55-0x000000007EDB0000-0x000000007EDB1000-memory.dmpFilesize
4KB
-
memory/1260-20-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1260-79-0x0000000009770000-0x0000000009771000-memory.dmpFilesize
4KB
-
memory/1260-71-0x00000000097D0000-0x00000000097D1000-memory.dmpFilesize
4KB
-
memory/1260-75-0x0000000009780000-0x0000000009781000-memory.dmpFilesize
4KB
-
memory/1260-25-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/1260-73-0x0000000003173000-0x0000000003174000-memory.dmpFilesize
4KB
-
memory/1456-9-0x0000000005B30000-0x0000000005BD3000-memory.dmpFilesize
652KB
-
memory/1456-29-0x00000000083F0000-0x00000000083F1000-memory.dmpFilesize
4KB
-
memory/1456-6-0x0000000006DD0000-0x0000000006DD1000-memory.dmpFilesize
4KB
-
memory/1456-5-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/1456-2-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1456-11-0x00000000080C0000-0x00000000080C1000-memory.dmpFilesize
4KB
-
memory/1456-10-0x00000000085C0000-0x00000000085C1000-memory.dmpFilesize
4KB
-
memory/1456-3-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/2068-12-0x0000000000000000-mapping.dmp
-
memory/2400-15-0x0000000000000000-mapping.dmp
-
memory/3248-36-0x0000000000000000-mapping.dmp
-
memory/3808-17-0x0000000000000000-mapping.dmp
-
memory/3808-43-0x0000000007D70000-0x0000000007D71000-memory.dmpFilesize
4KB
-
memory/3808-48-0x00000000085A0000-0x00000000085A1000-memory.dmpFilesize
4KB
-
memory/3808-38-0x0000000007E10000-0x0000000007E11000-memory.dmpFilesize
4KB
-
memory/3808-34-0x0000000007DA0000-0x0000000007DA1000-memory.dmpFilesize
4KB
-
memory/3808-32-0x0000000007AE0000-0x0000000007AE1000-memory.dmpFilesize
4KB
-
memory/3808-59-0x000000007F8A0000-0x000000007F8A1000-memory.dmpFilesize
4KB
-
memory/3808-67-0x0000000009250000-0x0000000009251000-memory.dmpFilesize
4KB
-
memory/3808-69-0x00000000093C0000-0x00000000093C1000-memory.dmpFilesize
4KB
-
memory/3808-30-0x0000000007410000-0x0000000007411000-memory.dmpFilesize
4KB
-
memory/3808-27-0x0000000001002000-0x0000000001003000-memory.dmpFilesize
4KB
-
memory/3808-74-0x0000000001003000-0x0000000001004000-memory.dmpFilesize
4KB
-
memory/3808-26-0x0000000001000000-0x0000000001001000-memory.dmpFilesize
4KB
-
memory/3808-23-0x0000000007440000-0x0000000007441000-memory.dmpFilesize
4KB
-
memory/3808-21-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/3808-19-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB