Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 09:17
Static task
static1
Behavioral task
behavioral1
Sample
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe
Resource
win7v20201028
General
-
Target
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe
-
Size
755KB
-
MD5
2641515da5144daf7c7058dbff699a23
-
SHA1
d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
-
SHA256
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
-
SHA512
81d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\I6L1bx4bXSC8VldD\\i3awrfENdCfF.exe\",explorer.exe" 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
svhoes.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts svhoes.exe -
Executes dropped EXE 1 IoCs
Processes:
svhoes.exepid process 4224 svhoes.exe -
Processes:
resource yara_rule behavioral2/memory/4224-3-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4224-9-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exedescription pid process target process PID 4760 set thread context of 4224 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exepid process 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exesvhoes.exedescription pid process Token: SeDebugPrivilege 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: 33 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: SeIncBasePriorityPrivilege 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: SeIncreaseQuotaPrivilege 4224 svhoes.exe Token: SeSecurityPrivilege 4224 svhoes.exe Token: SeTakeOwnershipPrivilege 4224 svhoes.exe Token: SeLoadDriverPrivilege 4224 svhoes.exe Token: SeSystemProfilePrivilege 4224 svhoes.exe Token: SeSystemtimePrivilege 4224 svhoes.exe Token: SeProfSingleProcessPrivilege 4224 svhoes.exe Token: SeIncBasePriorityPrivilege 4224 svhoes.exe Token: SeCreatePagefilePrivilege 4224 svhoes.exe Token: SeBackupPrivilege 4224 svhoes.exe Token: SeRestorePrivilege 4224 svhoes.exe Token: SeShutdownPrivilege 4224 svhoes.exe Token: SeDebugPrivilege 4224 svhoes.exe Token: SeSystemEnvironmentPrivilege 4224 svhoes.exe Token: SeChangeNotifyPrivilege 4224 svhoes.exe Token: SeRemoteShutdownPrivilege 4224 svhoes.exe Token: SeUndockPrivilege 4224 svhoes.exe Token: SeManageVolumePrivilege 4224 svhoes.exe Token: SeImpersonatePrivilege 4224 svhoes.exe Token: SeCreateGlobalPrivilege 4224 svhoes.exe Token: 33 4224 svhoes.exe Token: 34 4224 svhoes.exe Token: 35 4224 svhoes.exe Token: 36 4224 svhoes.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svhoes.exepid process 4224 svhoes.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exesvhoes.exedescription pid process target process PID 4760 wrote to memory of 4224 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 4760 wrote to memory of 4224 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 4760 wrote to memory of 4224 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 4760 wrote to memory of 4224 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 4760 wrote to memory of 4224 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 4760 wrote to memory of 4224 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 4760 wrote to memory of 4224 4760 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe PID 4224 wrote to memory of 4320 4224 svhoes.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe"C:\Users\Admin\AppData\Local\Temp\1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exe"C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exeMD5
2641515da5144daf7c7058dbff699a23
SHA1d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
SHA2561a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
SHA51281d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exeMD5
2641515da5144daf7c7058dbff699a23
SHA1d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
SHA2561a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
SHA51281d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
-
memory/4224-3-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4224-4-0x00000000004B56E0-mapping.dmp
-
memory/4224-9-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4224-10-0x00000000010B0000-0x00000000010B1000-memory.dmpFilesize
4KB
-
memory/4320-7-0x0000000000000000-mapping.dmp
-
memory/4320-8-0x00000000007E0000-0x00000000007E1000-memory.dmpFilesize
4KB
-
memory/4760-2-0x00000000016E0000-0x00000000016E1000-memory.dmpFilesize
4KB