Analysis
-
max time kernel
1720s -
max time network
1719s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-03-2021 07:08
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Install.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Install.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Install.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Install.exe
Resource
win7v20201028
General
-
Target
Install.exe
-
Size
852KB
-
MD5
98d1321a449526557d43498027e78a63
-
SHA1
d8584de7e33d30a8fc792b62aa7217d44332a345
-
SHA256
5440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
-
SHA512
3b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
multitimer.exemultitimer.exepid process 1308 multitimer.exe 1648 multitimer.exe -
Drops file in Windows directory 2 IoCs
Processes:
multitimer.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
Install.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Install.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Install.exedescription pid process Token: SeDebugPrivilege 1724 Install.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Install.exemultitimer.exedescription pid process target process PID 1724 wrote to memory of 1308 1724 Install.exe multitimer.exe PID 1724 wrote to memory of 1308 1724 Install.exe multitimer.exe PID 1724 wrote to memory of 1308 1724 Install.exe multitimer.exe PID 1308 wrote to memory of 1648 1308 multitimer.exe multitimer.exe PID 1308 wrote to memory of 1648 1308 multitimer.exe multitimer.exe PID 1308 wrote to memory of 1648 1308 multitimer.exe multitimer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FGQUJDCTMM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\FGQUJDCTMM\multitimer.exe" 0 3060197d33d91c80.94013368 0 1012⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FGQUJDCTMM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\FGQUJDCTMM\multitimer.exe" 1 1013⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FGQUJDCTMM\multitimer.exeMD5
004c561f04787d2e33ed0806fe900cdd
SHA17ec34d867dc658d96da4fbc6a1daedc75fe5f2fd
SHA256b905c0862fd8f733fa0302a31b3495f4eb02a840520775f9683c6e2f3fb160f6
SHA5123b0110c051bed613745ff05cad9e5ad85f6deb55146a3f6b2cf20a283dd21fbefad7eee826841088697f1cdf97b43889917c4af87f97cbc5754e4455f8086472
-
C:\Users\Admin\AppData\Local\Temp\FGQUJDCTMM\multitimer.exeMD5
004c561f04787d2e33ed0806fe900cdd
SHA17ec34d867dc658d96da4fbc6a1daedc75fe5f2fd
SHA256b905c0862fd8f733fa0302a31b3495f4eb02a840520775f9683c6e2f3fb160f6
SHA5123b0110c051bed613745ff05cad9e5ad85f6deb55146a3f6b2cf20a283dd21fbefad7eee826841088697f1cdf97b43889917c4af87f97cbc5754e4455f8086472
-
C:\Users\Admin\AppData\Local\Temp\FGQUJDCTMM\multitimer.exeMD5
004c561f04787d2e33ed0806fe900cdd
SHA17ec34d867dc658d96da4fbc6a1daedc75fe5f2fd
SHA256b905c0862fd8f733fa0302a31b3495f4eb02a840520775f9683c6e2f3fb160f6
SHA5123b0110c051bed613745ff05cad9e5ad85f6deb55146a3f6b2cf20a283dd21fbefad7eee826841088697f1cdf97b43889917c4af87f97cbc5754e4455f8086472
-
C:\Users\Admin\AppData\Local\Temp\FGQUJDCTMM\multitimer.exe.configMD5
3f1498c07d8713fe5c315db15a2a2cf3
SHA1ef5f42fd21f6e72bdc74794f2496884d9c40bbfb
SHA25652ca39624f8fd70bc441d055712f115856bc67b37efb860d654e4a8909106dc0
SHA512cb32ce5ef72548d1b0d27f3f254f4b67b23a0b662d0ef7ae12f9e3ef1b0a917b098368b434caf54751c02c0f930e92cffd384f105d8d79ee725df4d97a559a3d
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cchMD5
6b32cfdf545f3c39314e6e6a06e7dbd6
SHA1d38335eae73c6bc77b4a2e24983d9bf0db6b1d0f
SHA25649745f85c8bcfa91c82be64bdcdbd53fff1c6a6cd11d69196ddec95bd8ddd6a7
SHA5126e6e4d9e25a6a19be24ce4ad8406b10da82c9abed7086f3a20d2284778b6fa02fa680bb7f360a9a538b4ffe5a8d8babf8b22ff935ca364a157af4eaec179878e
-
memory/1308-11-0x00000000009C0000-0x00000000009C2000-memory.dmpFilesize
8KB
-
memory/1308-9-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/1308-10-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/1308-6-0x0000000000000000-mapping.dmp
-
memory/1648-13-0x0000000000000000-mapping.dmp
-
memory/1648-15-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/1648-16-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/1648-18-0x0000000000AB0000-0x0000000000AB2000-memory.dmpFilesize
8KB
-
memory/1724-2-0x000007FEF5F70000-0x000007FEF695C000-memory.dmpFilesize
9.9MB
-
memory/1724-5-0x000000001B560000-0x000000001B562000-memory.dmpFilesize
8KB
-
memory/1724-3-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB