Analysis
-
max time kernel
56s -
max time network
58s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 07:22
Static task
static1
Behavioral task
behavioral1
Sample
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe
Resource
win10v20201028
Errors
General
-
Target
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe
-
Size
755KB
-
MD5
2641515da5144daf7c7058dbff699a23
-
SHA1
d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
-
SHA256
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
-
SHA512
81d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\I6L1bx4bXSC8VldD\\TkSiNRUHd8wI.exe\",explorer.exe" 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
svhoes.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts svhoes.exe -
Executes dropped EXE 1 IoCs
Processes:
svhoes.exepid process 1644 svhoes.exe -
Processes:
resource yara_rule behavioral1/memory/1644-5-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1644-13-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exepid process 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exedescription pid process target process PID 1968 set thread context of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exepid process 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exesvhoes.exedescription pid process Token: SeDebugPrivilege 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: 33 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: SeIncBasePriorityPrivilege 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: SeIncreaseQuotaPrivilege 1644 svhoes.exe Token: SeSecurityPrivilege 1644 svhoes.exe Token: SeTakeOwnershipPrivilege 1644 svhoes.exe Token: SeLoadDriverPrivilege 1644 svhoes.exe Token: SeSystemProfilePrivilege 1644 svhoes.exe Token: SeSystemtimePrivilege 1644 svhoes.exe Token: SeProfSingleProcessPrivilege 1644 svhoes.exe Token: SeIncBasePriorityPrivilege 1644 svhoes.exe Token: SeCreatePagefilePrivilege 1644 svhoes.exe Token: SeBackupPrivilege 1644 svhoes.exe Token: SeRestorePrivilege 1644 svhoes.exe Token: SeShutdownPrivilege 1644 svhoes.exe Token: SeDebugPrivilege 1644 svhoes.exe Token: SeSystemEnvironmentPrivilege 1644 svhoes.exe Token: SeChangeNotifyPrivilege 1644 svhoes.exe Token: SeRemoteShutdownPrivilege 1644 svhoes.exe Token: SeUndockPrivilege 1644 svhoes.exe Token: SeManageVolumePrivilege 1644 svhoes.exe Token: SeImpersonatePrivilege 1644 svhoes.exe Token: SeCreateGlobalPrivilege 1644 svhoes.exe Token: 33 1644 svhoes.exe Token: 34 1644 svhoes.exe Token: 35 1644 svhoes.exe Token: SeShutdownPrivilege 1644 svhoes.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svhoes.exepid process 1644 svhoes.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exesvhoes.exedescription pid process target process PID 1968 wrote to memory of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 1968 wrote to memory of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 1968 wrote to memory of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 1968 wrote to memory of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 1968 wrote to memory of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 1968 wrote to memory of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 1968 wrote to memory of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 1968 wrote to memory of 1644 1968 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe PID 1644 wrote to memory of 916 1644 svhoes.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe"C:\Users\Admin\AppData\Local\Temp\1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exe"C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exeMD5
2641515da5144daf7c7058dbff699a23
SHA1d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
SHA2561a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
SHA51281d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exeMD5
2641515da5144daf7c7058dbff699a23
SHA1d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
SHA2561a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
SHA51281d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
-
\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exeMD5
2641515da5144daf7c7058dbff699a23
SHA1d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
SHA2561a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
SHA51281d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
-
memory/816-17-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/816-16-0x000007FEFB831000-0x000007FEFB833000-memory.dmpFilesize
8KB
-
memory/916-10-0x0000000000000000-mapping.dmp
-
memory/916-11-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/1204-19-0x0000000002740000-0x0000000002741000-memory.dmpFilesize
4KB
-
memory/1644-5-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1644-13-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1644-14-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/1644-6-0x00000000004B56E0-mapping.dmp
-
memory/1968-2-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/1968-3-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB