Resubmissions

15-11-2022 10:35

221115-mmn1esce3t 10

15-03-2021 11:09

210315-zqyylb62la 8

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-03-2021 11:09

General

  • Target

    2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe

  • Size

    362KB

  • MD5

    f1f48360f95e1b43e9fba0fec5a2afb8

  • SHA1

    70ceb467db7b0161d22e4545479f747417b9705a

  • SHA256

    2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49

  • SHA512

    88d945c7a064882681670d9402fb8d07cd0653f5d6e7801d95b0a4a840be2a362ccb11baa6911b47538681705a76d633d8fad374a6f541dd3ed651f3b63ae3b8

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
    "C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2588
  • C:\ProgramData\VirusMap\mcvsmap.exe
    C:\ProgramData\VirusMap\mcvsmap.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:424
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe 201 0
      2⤵
      • Deletes itself
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:184
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\system32\msiexec.exe 209 184
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:3816

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\SxS\bug.log
    MD5

    05bf76fd4e07e255d3f412b24565658f

    SHA1

    348f86676c1a2743bb4fedb6a736d35054404508

    SHA256

    29ab71c842ae7ed19b7800f40adb5a054a8c6c47d1deccffb0c24814f459d5b7

    SHA512

    2432922391521e9409ecaf59e8e1cab5eecd6472066083f55407bda94c4e3caa29094bb7eae534e7e09aba5491100d601da41e4b00cb6c950ad5b5a050234067

  • C:\ProgramData\SxS\bug.log
    MD5

    77d209e601b2860cf2e96ca20a2b9595

    SHA1

    cfbaf49de6807ceb32c1c948a6c40d1d7fc00429

    SHA256

    c1facdfca3f06d3fd18a49846399791510a093c943cb958b6b070f56c67195b8

    SHA512

    ac97331f8b44e42c068eee7f917388c1e391c28c08878cbfab6f6d7920e4c547886cf4b33bd23de9874e001f069d2f43bd84fb122aab37430316d6ec983d8e6f

  • C:\ProgramData\VirusMap\McUtil.dll
    MD5

    ad4a646b38a482cc07d5b09b4fffd3b3

    SHA1

    ae0f9bf2740d00c5d485827eb32aca33feaa3a90

    SHA256

    0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

    SHA512

    0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

  • C:\ProgramData\VirusMap\McUtil.dll.PPT
    MD5

    545bb4365a9b7cdb6d22844ebeedda93

    SHA1

    a267f1183b4ff843d68a63264846abf78cc71d1f

    SHA256

    d4fe890a08d4dd44b58a3b85b2a7e89536338099c1c42a9b7e85f4007b0a37b7

    SHA512

    b9c066f0166e8acbad1e822df8af6d69c7e23da33ff8b8bde9986222193e2be3d269866ec02a784e61d9cd160a8c5c299e04f9ab0981222521d4bb38f29b8e16

  • C:\ProgramData\VirusMap\mcvsmap.exe
    MD5

    4e1e0b8b0673937415599bf2f24c44ad

    SHA1

    9224de3af2a246011c6294f64f27206d165317ba

    SHA256

    ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

    SHA512

    87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

  • C:\ProgramData\VirusMap\mcvsmap.exe
    MD5

    4e1e0b8b0673937415599bf2f24c44ad

    SHA1

    9224de3af2a246011c6294f64f27206d165317ba

    SHA256

    ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

    SHA512

    87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll
    MD5

    ad4a646b38a482cc07d5b09b4fffd3b3

    SHA1

    ae0f9bf2740d00c5d485827eb32aca33feaa3a90

    SHA256

    0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

    SHA512

    0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll.PPT
    MD5

    545bb4365a9b7cdb6d22844ebeedda93

    SHA1

    a267f1183b4ff843d68a63264846abf78cc71d1f

    SHA256

    d4fe890a08d4dd44b58a3b85b2a7e89536338099c1c42a9b7e85f4007b0a37b7

    SHA512

    b9c066f0166e8acbad1e822df8af6d69c7e23da33ff8b8bde9986222193e2be3d269866ec02a784e61d9cd160a8c5c299e04f9ab0981222521d4bb38f29b8e16

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
    MD5

    4e1e0b8b0673937415599bf2f24c44ad

    SHA1

    9224de3af2a246011c6294f64f27206d165317ba

    SHA256

    ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

    SHA512

    87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
    MD5

    4e1e0b8b0673937415599bf2f24c44ad

    SHA1

    9224de3af2a246011c6294f64f27206d165317ba

    SHA256

    ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

    SHA512

    87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

  • \ProgramData\VirusMap\McUtil.DLL
    MD5

    ad4a646b38a482cc07d5b09b4fffd3b3

    SHA1

    ae0f9bf2740d00c5d485827eb32aca33feaa3a90

    SHA256

    0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

    SHA512

    0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

  • \Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.DLL
    MD5

    ad4a646b38a482cc07d5b09b4fffd3b3

    SHA1

    ae0f9bf2740d00c5d485827eb32aca33feaa3a90

    SHA256

    0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

    SHA512

    0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

  • memory/184-17-0x0000000000000000-mapping.dmp
  • memory/184-23-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
    Filesize

    4KB

  • memory/184-24-0x0000000003650000-0x0000000003681000-memory.dmp
    Filesize

    196KB

  • memory/424-22-0x0000000000DB0000-0x0000000000DE1000-memory.dmp
    Filesize

    196KB

  • memory/2588-7-0x00000000745A0000-0x0000000074633000-memory.dmp
    Filesize

    588KB

  • memory/2588-4-0x0000000000000000-mapping.dmp
  • memory/2588-11-0x00000000020C0000-0x00000000021C0000-memory.dmp
    Filesize

    1024KB

  • memory/2588-20-0x00000000021C0000-0x00000000021F1000-memory.dmp
    Filesize

    196KB

  • memory/3816-25-0x0000000000000000-mapping.dmp
  • memory/3816-27-0x0000000000E20000-0x0000000000E51000-memory.dmp
    Filesize

    196KB

  • memory/3816-26-0x00000000006F0000-0x00000000006F1000-memory.dmp
    Filesize

    4KB