Analysis
- max time kernel
148s - max time network
148s - platform
windows7_x64 - resource
win7v20201028 - submitted
28/02/2021, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe
- Size 1.1MB
- Sample210228-ppp7txqaan
- SHA256 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d
- MD5 5729a288911e360d25be9cd642356192
- SHA1 1063e58f7d6165f041307b68477eeb41a04358d6
- SHA512 c42fe9f4e391e39ecd226057991c54247c63df8388af973e3088aa4ac516add3229626870e09303473a50120d4b13db8cf19c14e720e51bd443d164a1cb7da02
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1952 server.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\960b0c14ade9b250558af4a4df5c1afaWindows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\960b0c14ade9b250558af4a4df5c1afaWindows Update.exe server.exe - Loads dropped DLL 2 IoCs
pid Process 1856 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 1856 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe - Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 1856 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe 1952 server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1952 server.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1856 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 1952 server.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1952 1856 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 27 PID 1856 wrote to memory of 1952 1856 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 27 PID 1856 wrote to memory of 1952 1856 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 27 PID 1856 wrote to memory of 1952 1856 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 27 PID 1952 wrote to memory of 1704 1952 server.exe 30 PID 1952 wrote to memory of 1704 1952 server.exe 30 PID 1952 wrote to memory of 1704 1952 server.exe 30 PID 1952 wrote to memory of 1704 1952 server.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe"C:\Users\Admin\AppData\Local\Temp\6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵PID:1704
-
-