Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe
Resource
win7v20201028
General
-
Target
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe
-
Size
755KB
-
MD5
2641515da5144daf7c7058dbff699a23
-
SHA1
d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
-
SHA256
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
-
SHA512
81d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\I6L1bx4bXSC8VldD\\G2C6ZZq1iT83.exe\",explorer.exe" 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
svhoes.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts svhoes.exe -
Executes dropped EXE 1 IoCs
Processes:
svhoes.exepid process 3156 svhoes.exe -
Processes:
resource yara_rule behavioral2/memory/3156-3-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3156-9-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exedescription pid process target process PID 640 set thread context of 3156 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exepid process 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exesvhoes.exedescription pid process Token: SeDebugPrivilege 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: 33 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: SeIncBasePriorityPrivilege 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe Token: SeIncreaseQuotaPrivilege 3156 svhoes.exe Token: SeSecurityPrivilege 3156 svhoes.exe Token: SeTakeOwnershipPrivilege 3156 svhoes.exe Token: SeLoadDriverPrivilege 3156 svhoes.exe Token: SeSystemProfilePrivilege 3156 svhoes.exe Token: SeSystemtimePrivilege 3156 svhoes.exe Token: SeProfSingleProcessPrivilege 3156 svhoes.exe Token: SeIncBasePriorityPrivilege 3156 svhoes.exe Token: SeCreatePagefilePrivilege 3156 svhoes.exe Token: SeBackupPrivilege 3156 svhoes.exe Token: SeRestorePrivilege 3156 svhoes.exe Token: SeShutdownPrivilege 3156 svhoes.exe Token: SeDebugPrivilege 3156 svhoes.exe Token: SeSystemEnvironmentPrivilege 3156 svhoes.exe Token: SeChangeNotifyPrivilege 3156 svhoes.exe Token: SeRemoteShutdownPrivilege 3156 svhoes.exe Token: SeUndockPrivilege 3156 svhoes.exe Token: SeManageVolumePrivilege 3156 svhoes.exe Token: SeImpersonatePrivilege 3156 svhoes.exe Token: SeCreateGlobalPrivilege 3156 svhoes.exe Token: 33 3156 svhoes.exe Token: 34 3156 svhoes.exe Token: 35 3156 svhoes.exe Token: 36 3156 svhoes.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svhoes.exepid process 3156 svhoes.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exesvhoes.exedescription pid process target process PID 640 wrote to memory of 3156 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 640 wrote to memory of 3156 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 640 wrote to memory of 3156 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 640 wrote to memory of 3156 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 640 wrote to memory of 3156 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 640 wrote to memory of 3156 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 640 wrote to memory of 3156 640 1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe svhoes.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe PID 3156 wrote to memory of 2336 3156 svhoes.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe"C:\Users\Admin\AppData\Local\Temp\1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exe"C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exeMD5
2641515da5144daf7c7058dbff699a23
SHA1d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
SHA2561a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
SHA51281d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
-
C:\Users\Admin\AppData\Local\Temp\ZhsTj7roVMp1HTa9\svhoes.exeMD5
2641515da5144daf7c7058dbff699a23
SHA1d16ad4ecb43e0294e51ad6b8341cb973b957c7e6
SHA2561a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8
SHA51281d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576
-
memory/640-2-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/2336-7-0x0000000000000000-mapping.dmp
-
memory/2336-8-0x0000000002700000-0x0000000002701000-memory.dmpFilesize
4KB
-
memory/3156-3-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3156-4-0x00000000004B56E0-mapping.dmp
-
memory/3156-9-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3156-10-0x0000000002A50000-0x0000000002A51000-memory.dmpFilesize
4KB