Analysis
- max time kernel
150s - max time network
144s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/03/2021, 08:18
Static task
static1
Behavioral task
behavioral1
Sample
1yiHAc52.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1yiHAc52.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 1yiHAc52.exe
- Size 32KB
- Sample210309-1xb488e486
- SHA256 46db080a3de7815c953820d44bb47f414c5edfe9ae083c3da0a9c5b3eb936028
- MD5 79b31319103df01b6569bb4db350fce4
- SHA1 a11769859d4a513605095bb635440eae757a5c49
- SHA512 c78dcd93bab91e3228ecca1ed15bc2ea36ab29b6d3271003ecf0f6a36ef42a2a340b690c725834a1018b7d723bd22ed2c500bc9d1b22644674a0a07b782b2269
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 460 server.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6748b11e71c40a887da25788a5d62d98.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6748b11e71c40a887da25788a5d62d98.exe server.exe - Loads dropped DLL 1 IoCs
pid Process 1932 1yiHAc52.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\6748b11e71c40a887da25788a5d62d98 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\6748b11e71c40a887da25788a5d62d98 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1932 1yiHAc52.exe 1932 1yiHAc52.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeDebugPrivilege 1932 1yiHAc52.exe Token: SeDebugPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe Token: 33 460 server.exe Token: SeIncBasePriorityPrivilege 460 server.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1932 wrote to memory of 460 1932 1yiHAc52.exe 29 PID 1932 wrote to memory of 460 1932 1yiHAc52.exe 29 PID 1932 wrote to memory of 460 1932 1yiHAc52.exe 29 PID 1932 wrote to memory of 460 1932 1yiHAc52.exe 29 PID 460 wrote to memory of 336 460 server.exe 30 PID 460 wrote to memory of 336 460 server.exe 30 PID 460 wrote to memory of 336 460 server.exe 30 PID 460 wrote to memory of 336 460 server.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1yiHAc52.exe"C:\Users\Admin\AppData\Local\Temp\1yiHAc52.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵PID:336
-
-