Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe
Resource
win10v20201028
General
-
Target
6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe
-
Size
1.1MB
-
MD5
facdb5b9a768ab4df00feecd3eb9afd3
-
SHA1
fb37dbc26452d92e86bf9a3db0601c780d8ab3ad
-
SHA256
6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437
-
SHA512
309857d485858504dc6f999febfa006910ae024c0b560e24d92d61ae473370a14243b19ae9ee1c004741015146c24bdb921b7dc0029d5f49856d9d708bc32c7d
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
easy.exepid process 3936 easy.exe -
Modifies Windows Firewall 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
easy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9b61017df30a5676ba2790bc11345aa8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\easy.exe\" .." easy.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b61017df30a5676ba2790bc11345aa8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\easy.exe\" .." easy.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exeeasy.exepid process 3584 6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe 3584 6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe 3936 easy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
easy.exedescription pid process Token: SeDebugPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe Token: 33 3936 easy.exe Token: SeIncBasePriorityPrivilege 3936 easy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exeeasy.exepid process 3584 6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe 3936 easy.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exeeasy.exedescription pid process target process PID 3584 wrote to memory of 3936 3584 6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe easy.exe PID 3584 wrote to memory of 3936 3584 6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe easy.exe PID 3584 wrote to memory of 3936 3584 6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe easy.exe PID 3936 wrote to memory of 2304 3936 easy.exe netsh.exe PID 3936 wrote to memory of 2304 3936 easy.exe netsh.exe PID 3936 wrote to memory of 2304 3936 easy.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe"C:\Users\Admin\AppData\Local\Temp\6685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Roaming\easy.exe"C:\Users\Admin\AppData\Roaming\easy.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\easy.exe" "easy.exe" ENABLE3⤵PID:2304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\easy.exeMD5
facdb5b9a768ab4df00feecd3eb9afd3
SHA1fb37dbc26452d92e86bf9a3db0601c780d8ab3ad
SHA2566685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437
SHA512309857d485858504dc6f999febfa006910ae024c0b560e24d92d61ae473370a14243b19ae9ee1c004741015146c24bdb921b7dc0029d5f49856d9d708bc32c7d
-
C:\Users\Admin\AppData\Roaming\easy.exeMD5
facdb5b9a768ab4df00feecd3eb9afd3
SHA1fb37dbc26452d92e86bf9a3db0601c780d8ab3ad
SHA2566685e3e49db6b1cdd7d3c631d5909d61422e23b3972c14d45bf9b09cce0da437
SHA512309857d485858504dc6f999febfa006910ae024c0b560e24d92d61ae473370a14243b19ae9ee1c004741015146c24bdb921b7dc0029d5f49856d9d708bc32c7d
-
memory/2304-11-0x0000000000000000-mapping.dmp
-
memory/3584-2-0x0000000003A20000-0x0000000003A21000-memory.dmpFilesize
4KB
-
memory/3584-4-0x0000000003C10000-0x0000000003C11000-memory.dmpFilesize
4KB
-
memory/3936-5-0x0000000000000000-mapping.dmp
-
memory/3936-8-0x0000000002F70000-0x0000000002F71000-memory.dmpFilesize
4KB
-
memory/3936-9-0x0000000003070000-0x0000000003071000-memory.dmpFilesize
4KB
-
memory/3936-10-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB