Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 07:23
Static task
static1
Behavioral task
behavioral1
Sample
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe
Resource
win7v20201028
General
-
Target
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe
-
Size
945KB
-
MD5
bbc4ea4288bb2ff094433b18d8468a8d
-
SHA1
72d8b5810a3b773bf11946061ad90a47a0558826
-
SHA256
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf
-
SHA512
c69a8a9ca5acea5a50d8ce9fea0e3e8146fcc34c97937ffffc44dc119f30f88db9ccd22c1c79f761d102fe75e220c1dfe2fc8bbcac7cb2ff5b4a70d6a222f006
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Processes:
resource yara_rule behavioral1/memory/1832-6-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1228-9-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1832-24-0x0000000000C80000-0x0000000000C96000-memory.dmp upx -
Drops startup file 2 IoCs
Processes:
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exepid process 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exedescription pid process target process PID 1724 set thread context of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exepid process 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.execalc.exepid process 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 1228 calc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exedescription pid process target process PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1724 wrote to memory of 1832 1724 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe PID 1832 wrote to memory of 1228 1832 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe calc.exe PID 1832 wrote to memory of 1228 1832 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe calc.exe PID 1832 wrote to memory of 1228 1832 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe calc.exe PID 1832 wrote to memory of 1228 1832 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe calc.exe PID 1832 wrote to memory of 1228 1832 735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe calc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe"C:\Users\Admin\AppData\Local\Temp\735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe"1⤵
- Drops startup file
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe"C:\Users\Admin\AppData\Local\Temp\735fd161c81fc144eb99d411ab096c6d21a844a8b9747006e9a2bbac729baadf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-26-0x000007FEF7D90000-0x000007FEF800A000-memory.dmpFilesize
2.5MB
-
memory/1228-9-0x0000000000C80000-0x0000000000C96000-memory.dmpFilesize
88KB
-
memory/1228-10-0x0000000000000000-mapping.dmp
-
memory/1724-21-0x0000000004600000-0x0000000004601000-memory.dmpFilesize
4KB
-
memory/1724-19-0x0000000004440000-0x0000000004441000-memory.dmpFilesize
4KB
-
memory/1724-2-0x0000000003C60000-0x0000000003C71000-memory.dmpFilesize
68KB
-
memory/1724-12-0x0000000000401000-0x0000000000418000-memory.dmpFilesize
92KB
-
memory/1724-13-0x00000000045D0000-0x00000000045D2000-memory.dmpFilesize
8KB
-
memory/1724-23-0x00000000045F0000-0x00000000045F1000-memory.dmpFilesize
4KB
-
memory/1724-22-0x0000000004460000-0x0000000004461000-memory.dmpFilesize
4KB
-
memory/1724-3-0x0000000004070000-0x0000000004081000-memory.dmpFilesize
68KB
-
memory/1724-20-0x0000000004470000-0x0000000004471000-memory.dmpFilesize
4KB
-
memory/1724-14-0x0000000004430000-0x0000000004431000-memory.dmpFilesize
4KB
-
memory/1724-18-0x0000000003FD0000-0x0000000003FD1000-memory.dmpFilesize
4KB
-
memory/1724-17-0x00000000045C0000-0x00000000045C1000-memory.dmpFilesize
4KB
-
memory/1724-16-0x00000000045E0000-0x00000000045E1000-memory.dmpFilesize
4KB
-
memory/1724-15-0x0000000003F80000-0x0000000003F81000-memory.dmpFilesize
4KB
-
memory/1832-8-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1832-24-0x0000000000C80000-0x0000000000C96000-memory.dmpFilesize
88KB
-
memory/1832-6-0x0000000000C80000-0x0000000000C96000-memory.dmpFilesize
88KB
-
memory/1832-7-0x0000000000C94870-mapping.dmp