Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-03-2021 16:40
Static task
static1
Behavioral task
behavioral1
Sample
7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe
Resource
win10v20201028
General
-
Target
7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe
-
Size
154KB
-
MD5
97f7bbf2f5861692617d661758bcf35b
-
SHA1
d59a0e3d77e22523a2fb657f756adebc32452ee0
-
SHA256
7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660
-
SHA512
eb8a846c2c16c3f405bf554ae715e915df680af0fd2901f427679a1cc5910ce5d2cb8e72c66ad2a6720093fde5c6156833aaa02655e5fd25a3e1b002251c7767
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
Processes:
resource yara_rule behavioral1/memory/1632-5-0x0000000000220000-0x0000000000238000-memory.dmp diamondfox behavioral1/memory/1632-6-0x0000000000400000-0x000000000041A000-memory.dmp diamondfox -
Executes dropped EXE 1 IoCs
Processes:
spoolsv.exepid process 952 spoolsv.exe -
Loads dropped DLL 2 IoCs
Processes:
powershell.exepid process 1512 powershell.exe 1512 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exepid process 1512 powershell.exe 1512 powershell.exe 924 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 924 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exespoolsv.exepid process 1632 7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe 952 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exepowershell.exespoolsv.exedescription pid process target process PID 1632 wrote to memory of 1512 1632 7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe powershell.exe PID 1632 wrote to memory of 1512 1632 7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe powershell.exe PID 1632 wrote to memory of 1512 1632 7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe powershell.exe PID 1632 wrote to memory of 1512 1632 7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe powershell.exe PID 1512 wrote to memory of 952 1512 powershell.exe spoolsv.exe PID 1512 wrote to memory of 952 1512 powershell.exe spoolsv.exe PID 1512 wrote to memory of 952 1512 powershell.exe spoolsv.exe PID 1512 wrote to memory of 952 1512 powershell.exe spoolsv.exe PID 952 wrote to memory of 924 952 spoolsv.exe powershell.exe PID 952 wrote to memory of 924 952 spoolsv.exe powershell.exe PID 952 wrote to memory of 924 952 spoolsv.exe powershell.exe PID 952 wrote to memory of 924 952 spoolsv.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe"C:\Users\Admin\AppData\Local\Temp\7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\7b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660.exe' -Destination 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe'2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe"C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell $shell = New-Object -ComObject WScript.Shell;$shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk');$shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exe';$shortcut.Save()4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\svlspoo\spoolsv.exeMD5
97f7bbf2f5861692617d661758bcf35b
SHA1d59a0e3d77e22523a2fb657f756adebc32452ee0
SHA2567b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660
SHA512eb8a846c2c16c3f405bf554ae715e915df680af0fd2901f427679a1cc5910ce5d2cb8e72c66ad2a6720093fde5c6156833aaa02655e5fd25a3e1b002251c7767
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
73dcafa56c27022390c33867599c2eba
SHA14874f3adb6e75220696f1ce7ee8cbd8cd794ef0f
SHA256f637eabef3d4e69674b6fe9b645ecd338743d4d06db462db0729d1401791f7c3
SHA512a7a8733f61b6c3a7fb437f7094cb5aa0479c0d0d961f907fd31707e755841987730fafdcea7cdbbd7c8397ce755453c94d627469701491121f1e94a908899a83
-
\Users\Admin\AppData\Local\svlspoo\spoolsv.exeMD5
97f7bbf2f5861692617d661758bcf35b
SHA1d59a0e3d77e22523a2fb657f756adebc32452ee0
SHA2567b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660
SHA512eb8a846c2c16c3f405bf554ae715e915df680af0fd2901f427679a1cc5910ce5d2cb8e72c66ad2a6720093fde5c6156833aaa02655e5fd25a3e1b002251c7767
-
\Users\Admin\AppData\Local\svlspoo\spoolsv.exeMD5
97f7bbf2f5861692617d661758bcf35b
SHA1d59a0e3d77e22523a2fb657f756adebc32452ee0
SHA2567b2944122a7d202bf76e409529d9e05d2caf327372715b2361fbc6ec7c2ac660
SHA512eb8a846c2c16c3f405bf554ae715e915df680af0fd2901f427679a1cc5910ce5d2cb8e72c66ad2a6720093fde5c6156833aaa02655e5fd25a3e1b002251c7767
-
memory/924-47-0x0000000073850000-0x0000000073F3E000-memory.dmpFilesize
6.9MB
-
memory/924-48-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/924-49-0x0000000004890000-0x0000000004891000-memory.dmpFilesize
4KB
-
memory/924-50-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/924-44-0x0000000000000000-mapping.dmp
-
memory/924-51-0x0000000004852000-0x0000000004853000-memory.dmpFilesize
4KB
-
memory/924-52-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/952-38-0x0000000004D60000-0x0000000004D71000-memory.dmpFilesize
68KB
-
memory/952-36-0x0000000000000000-mapping.dmp
-
memory/1512-11-0x00000000048B0000-0x00000000048B1000-memory.dmpFilesize
4KB
-
memory/1512-13-0x0000000004872000-0x0000000004873000-memory.dmpFilesize
4KB
-
memory/1512-31-0x0000000006200000-0x0000000006201000-memory.dmpFilesize
4KB
-
memory/1512-32-0x00000000064D0000-0x00000000064D1000-memory.dmpFilesize
4KB
-
memory/1512-33-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1512-23-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/1512-18-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/1512-15-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/1512-14-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/1512-24-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/1512-12-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/1512-7-0x0000000000000000-mapping.dmp
-
memory/1512-10-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/1512-9-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1512-8-0x0000000076341000-0x0000000076343000-memory.dmpFilesize
8KB
-
memory/1632-2-0x0000000004C30000-0x0000000004C41000-memory.dmpFilesize
68KB
-
memory/1632-6-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1632-5-0x0000000000220000-0x0000000000238000-memory.dmpFilesize
96KB