Analysis
- max time kernel
150s - max time network
143s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/03/2021, 08:18
Static task
static1
Behavioral task
behavioral1
Sample
1yiHAc52.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1yiHAc52.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 1yiHAc52.exe
- Size 32KB
- Sample210309-1xb488e486
- SHA256 46db080a3de7815c953820d44bb47f414c5edfe9ae083c3da0a9c5b3eb936028
- MD5 79b31319103df01b6569bb4db350fce4
- SHA1 a11769859d4a513605095bb635440eae757a5c49
- SHA512 c78dcd93bab91e3228ecca1ed15bc2ea36ab29b6d3271003ecf0f6a36ef42a2a340b690c725834a1018b7d723bd22ed2c500bc9d1b22644674a0a07b782b2269
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3244 server.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6748b11e71c40a887da25788a5d62d98.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6748b11e71c40a887da25788a5d62d98.exe server.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\6748b11e71c40a887da25788a5d62d98 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6748b11e71c40a887da25788a5d62d98 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 540 1yiHAc52.exe 540 1yiHAc52.exe - Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeDebugPrivilege 540 1yiHAc52.exe Token: SeDebugPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe Token: 33 3244 server.exe Token: SeIncBasePriorityPrivilege 3244 server.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 540 wrote to memory of 3244 540 1yiHAc52.exe 78 PID 540 wrote to memory of 3244 540 1yiHAc52.exe 78 PID 540 wrote to memory of 3244 540 1yiHAc52.exe 78 PID 3244 wrote to memory of 3544 3244 server.exe 79 PID 3244 wrote to memory of 3544 3244 server.exe 79 PID 3244 wrote to memory of 3544 3244 server.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\1yiHAc52.exe"C:\Users\Admin\AppData\Local\Temp\1yiHAc52.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵PID:3544
-
-