Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 11:16
Static task
static1
Behavioral task
behavioral1
Sample
1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe
Resource
win7v20201028
General
-
Target
1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe
-
Size
594KB
-
MD5
6815e92e3b69abb83257aff53ccf411b
-
SHA1
dd588b78d08d8eea3f553fe1cec692ac2340111b
-
SHA256
1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
-
SHA512
1227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svhostis.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\skypes.exe" svhostis.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
svhostis.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts svhostis.exe -
Executes dropped EXE 3 IoCs
Processes:
svhostis.exeskypes.exesvhostis.exepid process 1320 svhostis.exe 1500 skypes.exe 912 svhostis.exe -
Processes:
resource yara_rule behavioral1/memory/1320-5-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1320-12-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/912-31-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exesvhostis.exeskypes.exepid process 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe 1320 svhostis.exe 1500 skypes.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svhostis.exesvhostis.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\skype64 = "C:\\Users\\Admin\\Documents\\skypes.exe" svhostis.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\skype64 = "C:\\Users\\Admin\\Documents\\skypes.exe" svhostis.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exeskypes.exedescription pid process target process PID 1044 set thread context of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1500 set thread context of 912 1500 skypes.exe svhostis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exeskypes.exepid process 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe 1500 skypes.exe 1500 skypes.exe 1500 skypes.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
Processes:
1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exesvhostis.exeskypes.exesvhostis.exedescription pid process Token: SeDebugPrivilege 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe Token: 33 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe Token: SeIncBasePriorityPrivilege 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe Token: SeIncreaseQuotaPrivilege 1320 svhostis.exe Token: SeSecurityPrivilege 1320 svhostis.exe Token: SeTakeOwnershipPrivilege 1320 svhostis.exe Token: SeLoadDriverPrivilege 1320 svhostis.exe Token: SeSystemProfilePrivilege 1320 svhostis.exe Token: SeSystemtimePrivilege 1320 svhostis.exe Token: SeProfSingleProcessPrivilege 1320 svhostis.exe Token: SeIncBasePriorityPrivilege 1320 svhostis.exe Token: SeCreatePagefilePrivilege 1320 svhostis.exe Token: SeBackupPrivilege 1320 svhostis.exe Token: SeRestorePrivilege 1320 svhostis.exe Token: SeShutdownPrivilege 1320 svhostis.exe Token: SeDebugPrivilege 1320 svhostis.exe Token: SeSystemEnvironmentPrivilege 1320 svhostis.exe Token: SeChangeNotifyPrivilege 1320 svhostis.exe Token: SeRemoteShutdownPrivilege 1320 svhostis.exe Token: SeUndockPrivilege 1320 svhostis.exe Token: SeManageVolumePrivilege 1320 svhostis.exe Token: SeImpersonatePrivilege 1320 svhostis.exe Token: SeCreateGlobalPrivilege 1320 svhostis.exe Token: 33 1320 svhostis.exe Token: 34 1320 svhostis.exe Token: 35 1320 svhostis.exe Token: SeDebugPrivilege 1500 skypes.exe Token: 33 1500 skypes.exe Token: SeIncBasePriorityPrivilege 1500 skypes.exe Token: SeIncreaseQuotaPrivilege 912 svhostis.exe Token: SeSecurityPrivilege 912 svhostis.exe Token: SeTakeOwnershipPrivilege 912 svhostis.exe Token: SeLoadDriverPrivilege 912 svhostis.exe Token: SeSystemProfilePrivilege 912 svhostis.exe Token: SeSystemtimePrivilege 912 svhostis.exe Token: SeProfSingleProcessPrivilege 912 svhostis.exe Token: SeIncBasePriorityPrivilege 912 svhostis.exe Token: SeCreatePagefilePrivilege 912 svhostis.exe Token: SeBackupPrivilege 912 svhostis.exe Token: SeRestorePrivilege 912 svhostis.exe Token: SeShutdownPrivilege 912 svhostis.exe Token: SeDebugPrivilege 912 svhostis.exe Token: SeSystemEnvironmentPrivilege 912 svhostis.exe Token: SeChangeNotifyPrivilege 912 svhostis.exe Token: SeRemoteShutdownPrivilege 912 svhostis.exe Token: SeUndockPrivilege 912 svhostis.exe Token: SeManageVolumePrivilege 912 svhostis.exe Token: SeImpersonatePrivilege 912 svhostis.exe Token: SeCreateGlobalPrivilege 912 svhostis.exe Token: 33 912 svhostis.exe Token: 34 912 svhostis.exe Token: 35 912 svhostis.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svhostis.exepid process 912 svhostis.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exesvhostis.exeskypes.exesvhostis.exedescription pid process target process PID 1044 wrote to memory of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1044 wrote to memory of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1044 wrote to memory of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1044 wrote to memory of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1044 wrote to memory of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1044 wrote to memory of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1044 wrote to memory of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1044 wrote to memory of 1320 1044 1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe svhostis.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1452 1320 svhostis.exe notepad.exe PID 1320 wrote to memory of 1500 1320 svhostis.exe skypes.exe PID 1320 wrote to memory of 1500 1320 svhostis.exe skypes.exe PID 1320 wrote to memory of 1500 1320 svhostis.exe skypes.exe PID 1320 wrote to memory of 1500 1320 svhostis.exe skypes.exe PID 1500 wrote to memory of 912 1500 skypes.exe svhostis.exe PID 1500 wrote to memory of 912 1500 skypes.exe svhostis.exe PID 1500 wrote to memory of 912 1500 skypes.exe svhostis.exe PID 1500 wrote to memory of 912 1500 skypes.exe svhostis.exe PID 1500 wrote to memory of 912 1500 skypes.exe svhostis.exe PID 1500 wrote to memory of 912 1500 skypes.exe svhostis.exe PID 1500 wrote to memory of 912 1500 skypes.exe svhostis.exe PID 1500 wrote to memory of 912 1500 skypes.exe svhostis.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe PID 912 wrote to memory of 956 912 svhostis.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe"C:\Users\Admin\AppData\Local\Temp\1810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exe"C:\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exe"2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1452
-
C:\Users\Admin\Documents\skypes.exe"C:\Users\Admin\Documents\skypes.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exe"C:\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:956
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
C:\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
C:\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
C:\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
C:\Users\Admin\Documents\skypes.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
C:\Users\Admin\Documents\skypes.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
\Users\Admin\AppData\Local\Temp\vY5tyhPjQ9k3sUGd\svhostis.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
\Users\Admin\Documents\skypes.exeMD5
6815e92e3b69abb83257aff53ccf411b
SHA1dd588b78d08d8eea3f553fe1cec692ac2340111b
SHA2561810092b7599bad7adea10aeaf4df0c2af29fc85c0904662bab674f231752e22
SHA5121227bf5619eb7ae56ca4382db764cb55db5a77c3f549cfc478ddee59e35f24408848e737f005209ffa289414a2eb6f5128bd002c95448b103485e33f5bb054a1
-
memory/912-33-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/912-24-0x00000000004B57C0-mapping.dmp
-
memory/912-31-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/956-28-0x0000000000000000-mapping.dmp
-
memory/956-29-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1044-2-0x00000000760A1000-0x00000000760A3000-memory.dmpFilesize
8KB
-
memory/1044-3-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/1320-6-0x00000000004B57C0-mapping.dmp
-
memory/1320-12-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-5-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-13-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1452-10-0x0000000000000000-mapping.dmp
-
memory/1452-11-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/1500-21-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/1500-16-0x0000000000000000-mapping.dmp