Analysis
-
max time kernel
297s -
max time network
296s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-03-2021 08:03
Static task
static1
Behavioral task
behavioral1
Sample
LavaCraft.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
LavaCraft.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
LavaCraft.exe
-
Size
1.3MB
-
MD5
8609e5d84c7149a6addfa9b4dc991a47
-
SHA1
945dbacb3ee32fe07e8058c03b3ea2f3f78dec83
-
SHA256
9722e6e82f7ac47686931a1e90e8dff0d536e08ff934286da737572ea2e1f8a3
-
SHA512
56d16bf56fb0e5e2a0b1524b2352cb4bdb9671dbf1c096744f806ef62bc49f4426c1359a9b0e427981ed89a4c1121241a0b69346bbff624b7ecd079a68b00134
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 3340 LavaCraft.exe 4032 7za.exe 3352 javaw.exe 3204 LavaCraft.exe -
resource yara_rule behavioral1/files/0x000100000001ab74-29.dat upx behavioral1/files/0x000100000001ae7e-35.dat upx behavioral1/files/0x000100000001ab74-36.dat upx behavioral1/files/0x000200000001ae7e-55.dat upx behavioral1/files/0x000200000001ae7e-57.dat upx behavioral1/files/0x000200000001ae7e-56.dat upx -
Loads dropped DLL 16 IoCs
pid Process 3340 LavaCraft.exe 3340 LavaCraft.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe 3352 javaw.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini bcastdvr.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 LavaCraft.exe -
Drops file in Windows directory 50 IoCs
description ioc Process File created C:\Windows\INF\ts_generic.PNF LavaCraft.exe File created C:\Windows\INF\c_fsantivirus.PNF LavaCraft.exe File created C:\Windows\INF\c_linedisplay.PNF LavaCraft.exe File created C:\Windows\INF\c_proximity.PNF LavaCraft.exe File created C:\Windows\INF\c_cashdrawer.PNF LavaCraft.exe File created C:\Windows\INF\oposdrv.PNF LavaCraft.exe File created C:\Windows\INF\rawsilo.PNF LavaCraft.exe File created C:\Windows\INF\c_fsencryption.PNF LavaCraft.exe File created C:\Windows\INF\c_receiptprinter.PNF LavaCraft.exe File created C:\Windows\INF\c_firmware.PNF LavaCraft.exe File created C:\Windows\INF\c_magneticstripereader.PNF LavaCraft.exe File created C:\Windows\INF\c_mcx.PNF LavaCraft.exe File created C:\Windows\INF\c_apo.PNF LavaCraft.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF LavaCraft.exe File created C:\Windows\INF\c_monitor.PNF LavaCraft.exe File created C:\Windows\INF\c_scmvolume.PNF LavaCraft.exe File created C:\Windows\INF\c_netdriver.PNF LavaCraft.exe File created C:\Windows\INF\ramdisk.PNF LavaCraft.exe File created C:\Windows\INF\wsdprint.PNF LavaCraft.exe File created C:\Windows\INF\dc1-controller.PNF LavaCraft.exe File created C:\Windows\INF\digitalmediadevice.PNF LavaCraft.exe File created C:\Windows\INF\c_fssystemrecovery.PNF LavaCraft.exe File created C:\Windows\INF\c_fsinfrastructure.PNF LavaCraft.exe File created C:\Windows\INF\c_fsvirtualization.PNF LavaCraft.exe File created C:\Windows\INF\remoteposdrv.PNF LavaCraft.exe File created C:\Windows\INF\c_fssystem.PNF LavaCraft.exe File created C:\Windows\INF\c_fshsm.PNF LavaCraft.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF LavaCraft.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF LavaCraft.exe File created C:\Windows\INF\c_holographic.PNF LavaCraft.exe File created C:\Windows\INF\c_scmdisk.PNF LavaCraft.exe File created C:\Windows\INF\c_swcomponent.PNF LavaCraft.exe File created C:\Windows\INF\PerceptionSimulationSixDof.PNF LavaCraft.exe File created C:\Windows\INF\miradisp.PNF LavaCraft.exe File created C:\Windows\INF\c_fsundelete.PNF LavaCraft.exe File created C:\Windows\INF\c_fsreplication.PNF LavaCraft.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF LavaCraft.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF LavaCraft.exe File created C:\Windows\INF\c_volume.PNF LavaCraft.exe File created C:\Windows\INF\c_fsquotamgmt.PNF LavaCraft.exe File created C:\Windows\INF\c_barcodescanner.PNF LavaCraft.exe File created C:\Windows\INF\xusb22.PNF LavaCraft.exe File created C:\Windows\INF\c_sslaccel.PNF LavaCraft.exe File created C:\Windows\INF\c_processor.PNF LavaCraft.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF LavaCraft.exe File created C:\Windows\INF\c_extension.PNF LavaCraft.exe File created C:\Windows\INF\c_fscompression.PNF LavaCraft.exe File created C:\Windows\INF\c_fscontentscreener.PNF LavaCraft.exe File created C:\Windows\INF\c_diskdrive.PNF LavaCraft.exe File created C:\Windows\INF\c_fscopyprotection.PNF LavaCraft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags GamePanel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 LavaCraft.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName LavaCraft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 LavaCraft.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName LavaCraft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 GamePanel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags GamePanel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 GamePanel.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1148 tasklist.exe 1368 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1160 LavaCraft.exe 1160 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe 3340 LavaCraft.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1160 LavaCraft.exe Token: SeDebugPrivilege 1148 tasklist.exe Token: SeDebugPrivilege 1368 tasklist.exe Token: SeDebugPrivilege 3340 LavaCraft.exe Token: SeDebugPrivilege 3204 LavaCraft.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3352 javaw.exe 3352 javaw.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1160 wrote to memory of 1372 1160 LavaCraft.exe 76 PID 1160 wrote to memory of 1372 1160 LavaCraft.exe 76 PID 1372 wrote to memory of 1148 1372 cmd.exe 78 PID 1372 wrote to memory of 1148 1372 cmd.exe 78 PID 1372 wrote to memory of 816 1372 cmd.exe 79 PID 1372 wrote to memory of 816 1372 cmd.exe 79 PID 1372 wrote to memory of 1368 1372 cmd.exe 80 PID 1372 wrote to memory of 1368 1372 cmd.exe 80 PID 1372 wrote to memory of 3324 1372 cmd.exe 81 PID 1372 wrote to memory of 3324 1372 cmd.exe 81 PID 1372 wrote to memory of 3340 1372 cmd.exe 82 PID 1372 wrote to memory of 3340 1372 cmd.exe 82 PID 3340 wrote to memory of 4032 3340 LavaCraft.exe 88 PID 3340 wrote to memory of 4032 3340 LavaCraft.exe 88 PID 3340 wrote to memory of 4032 3340 LavaCraft.exe 88 PID 3340 wrote to memory of 3352 3340 LavaCraft.exe 90 PID 3340 wrote to memory of 3352 3340 LavaCraft.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\LavaCraft.exe"C:\Users\Admin\AppData\Local\Temp\LavaCraft.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\.LavaServer\run.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq LavaCraft.exe" /NH3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\system32\findstr.exefindstr /i "LavaCraft.exe"3⤵PID:816
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq LavaCraft.exe" /NH3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
C:\Windows\system32\findstr.exefindstr /i "LavaCraft.exe"3⤵PID:3324
-
-
C:\Users\Admin\AppData\Roaming\.LavaServer\LavaCraft.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\LavaCraft.exe" "C:\Users\Admin\AppData\Local\Temp\LavaCraft.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Roaming\.LavaServer\7za.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\7za.exe" x -r "C:\Users\Admin\AppData\Roaming\.LavaServer\java64.zip" -o"C:\Users\Admin\AppData\Roaming\.LavaServer\java"4⤵
- Executes dropped EXE
PID:4032
-
-
C:\Users\Admin\AppData\Roaming\.LavaServer\java\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\java\bin\javaw.exe" -XX:+DisableAttachMechanism -Xms512m -Xmx1024m -cp "C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\minecraft.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\jinput.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\lwjgl.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\lwjgl_util.jar" -Djava.library.path="C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\natives" net.minecraft.client.Minecraft Krevetka260 107446909215118589317 195.201.156.42 25569 6 http://lavacraft.ru::beget=begetok http://img.lavacraft.ru4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3352
-
-
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:1580
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 0000000000020252 /startuptips1⤵
- Checks SCSI registry key(s)
PID:3020
-
C:\Windows\System32\bcastdvr.exe"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer1⤵
- Drops desktop.ini file(s)
PID:3524
-
C:\Users\Admin\AppData\Roaming\.LavaServer\LavaCraft.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\LavaCraft.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3204