Analysis
- max time kernel
150s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/02/2021, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe
- Size 1.1MB
- Sample210228-ppp7txqaan
- SHA256 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d
- MD5 5729a288911e360d25be9cd642356192
- SHA1 1063e58f7d6165f041307b68477eeb41a04358d6
- SHA512 c42fe9f4e391e39ecd226057991c54247c63df8388af973e3088aa4ac516add3229626870e09303473a50120d4b13db8cf19c14e720e51bd443d164a1cb7da02
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3500 server.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\960b0c14ade9b250558af4a4df5c1afaWindows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\960b0c14ade9b250558af4a4df5c1afaWindows Update.exe server.exe - Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 508 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe 3500 server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3500 server.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe Token: 33 3500 server.exe Token: SeIncBasePriorityPrivilege 3500 server.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 508 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 3500 server.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 508 wrote to memory of 3500 508 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 75 PID 508 wrote to memory of 3500 508 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 75 PID 508 wrote to memory of 3500 508 6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe 75 PID 3500 wrote to memory of 200 3500 server.exe 76 PID 3500 wrote to memory of 200 3500 server.exe 76 PID 3500 wrote to memory of 200 3500 server.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe"C:\Users\Admin\AppData\Local\Temp\6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵PID:200
-
-