Analysis
-
max time kernel
496s -
max time network
403s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-03-2021 08:03
Static task
static1
Behavioral task
behavioral1
Sample
LavaCraft.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
LavaCraft.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
LavaCraft.exe
-
Size
1.3MB
-
MD5
8609e5d84c7149a6addfa9b4dc991a47
-
SHA1
945dbacb3ee32fe07e8058c03b3ea2f3f78dec83
-
SHA256
9722e6e82f7ac47686931a1e90e8dff0d536e08ff934286da737572ea2e1f8a3
-
SHA512
56d16bf56fb0e5e2a0b1524b2352cb4bdb9671dbf1c096744f806ef62bc49f4426c1359a9b0e427981ed89a4c1121241a0b69346bbff624b7ecd079a68b00134
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 2584 LavaCraft.exe 2500 7za.exe 1712 javaw.exe 2276 LavaCraft.exe 184 javaw.exe -
resource yara_rule behavioral2/files/0x000500000001a4e6-34.dat upx behavioral2/files/0x000500000001a4e6-33.dat upx behavioral2/files/0x000100000001ae8b-40.dat upx behavioral2/files/0x000500000001a4e6-41.dat upx behavioral2/files/0x000500000001a4e6-42.dat upx behavioral2/files/0x000200000001ae8b-59.dat upx behavioral2/files/0x000200000001ae8b-60.dat upx -
Loads dropped DLL 35 IoCs
pid Process 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 2276 LavaCraft.exe 2276 LavaCraft.exe 2276 LavaCraft.exe 2276 LavaCraft.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe 184 javaw.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini bcastdvr.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 LavaCraft.exe File opened for modification \??\PhysicalDrive0 LavaCraft.exe -
Drops file in Windows directory 50 IoCs
description ioc Process File created C:\Windows\INF\c_fscontentscreener.PNF LavaCraft.exe File created C:\Windows\INF\c_monitor.PNF LavaCraft.exe File created C:\Windows\INF\c_processor.PNF LavaCraft.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF LavaCraft.exe File created C:\Windows\INF\c_extension.PNF LavaCraft.exe File created C:\Windows\INF\digitalmediadevice.PNF LavaCraft.exe File created C:\Windows\INF\c_diskdrive.PNF LavaCraft.exe File created C:\Windows\INF\c_volume.PNF LavaCraft.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF LavaCraft.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF LavaCraft.exe File created C:\Windows\INF\c_fscompression.PNF LavaCraft.exe File created C:\Windows\INF\c_fsvirtualization.PNF LavaCraft.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF LavaCraft.exe File created C:\Windows\INF\c_magneticstripereader.PNF LavaCraft.exe File created C:\Windows\INF\c_scmdisk.PNF LavaCraft.exe File created C:\Windows\INF\c_netdriver.PNF LavaCraft.exe File created C:\Windows\INF\c_barcodescanner.PNF LavaCraft.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF LavaCraft.exe File created C:\Windows\INF\c_fsundelete.PNF LavaCraft.exe File created C:\Windows\INF\dc1-controller.PNF LavaCraft.exe File created C:\Windows\INF\c_fsreplication.PNF LavaCraft.exe File created C:\Windows\INF\PerceptionSimulationSixDof.PNF LavaCraft.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF LavaCraft.exe File created C:\Windows\INF\c_mcx.PNF LavaCraft.exe File created C:\Windows\INF\c_fsquotamgmt.PNF LavaCraft.exe File created C:\Windows\INF\rawsilo.PNF LavaCraft.exe File created C:\Windows\INF\c_fsantivirus.PNF LavaCraft.exe File created C:\Windows\INF\c_receiptprinter.PNF LavaCraft.exe File created C:\Windows\INF\ramdisk.PNF LavaCraft.exe File created C:\Windows\INF\wsdprint.PNF LavaCraft.exe File created C:\Windows\INF\miradisp.PNF LavaCraft.exe File created C:\Windows\INF\c_fssystemrecovery.PNF LavaCraft.exe File created C:\Windows\INF\c_scmvolume.PNF LavaCraft.exe File created C:\Windows\INF\c_proximity.PNF LavaCraft.exe File created C:\Windows\INF\c_fssystem.PNF LavaCraft.exe File created C:\Windows\INF\c_fscopyprotection.PNF LavaCraft.exe File created C:\Windows\INF\xusb22.PNF LavaCraft.exe File created C:\Windows\INF\c_fsinfrastructure.PNF LavaCraft.exe File created C:\Windows\INF\remoteposdrv.PNF LavaCraft.exe File created C:\Windows\INF\c_sslaccel.PNF LavaCraft.exe File created C:\Windows\INF\c_swcomponent.PNF LavaCraft.exe File created C:\Windows\INF\c_fsencryption.PNF LavaCraft.exe File created C:\Windows\INF\c_holographic.PNF LavaCraft.exe File created C:\Windows\INF\c_fshsm.PNF LavaCraft.exe File created C:\Windows\INF\c_firmware.PNF LavaCraft.exe File created C:\Windows\INF\c_linedisplay.PNF LavaCraft.exe File created C:\Windows\INF\c_apo.PNF LavaCraft.exe File created C:\Windows\INF\oposdrv.PNF LavaCraft.exe File created C:\Windows\INF\c_cashdrawer.PNF LavaCraft.exe File created C:\Windows\INF\ts_generic.PNF LavaCraft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName LavaCraft.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName LavaCraft.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName LavaCraft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 GamePanel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags GamePanel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 LavaCraft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 GamePanel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags GamePanel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 GamePanel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName LavaCraft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 LavaCraft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 LavaCraft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 GamePanel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags GamePanel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 LavaCraft.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags GamePanel.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 bcastdvr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bcastdvr.exe -
Enumerates processes with tasklist 1 TTPs 4 IoCs
pid Process 812 tasklist.exe 2520 tasklist.exe 1768 tasklist.exe 4092 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1316 LavaCraft.exe 1316 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe 2584 LavaCraft.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1316 LavaCraft.exe Token: SeDebugPrivilege 812 tasklist.exe Token: SeDebugPrivilege 2520 tasklist.exe Token: SeDebugPrivilege 1768 tasklist.exe Token: SeDebugPrivilege 4092 tasklist.exe Token: SeDebugPrivilege 2584 LavaCraft.exe Token: SeDebugPrivilege 2276 LavaCraft.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1712 javaw.exe 1712 javaw.exe 184 javaw.exe 184 javaw.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1316 wrote to memory of 1984 1316 LavaCraft.exe 75 PID 1316 wrote to memory of 1984 1316 LavaCraft.exe 75 PID 1984 wrote to memory of 812 1984 cmd.exe 77 PID 1984 wrote to memory of 812 1984 cmd.exe 77 PID 1984 wrote to memory of 1864 1984 cmd.exe 78 PID 1984 wrote to memory of 1864 1984 cmd.exe 78 PID 1984 wrote to memory of 2520 1984 cmd.exe 79 PID 1984 wrote to memory of 2520 1984 cmd.exe 79 PID 1984 wrote to memory of 3668 1984 cmd.exe 80 PID 1984 wrote to memory of 3668 1984 cmd.exe 80 PID 1984 wrote to memory of 1768 1984 cmd.exe 81 PID 1984 wrote to memory of 1768 1984 cmd.exe 81 PID 1984 wrote to memory of 2100 1984 cmd.exe 82 PID 1984 wrote to memory of 2100 1984 cmd.exe 82 PID 1984 wrote to memory of 4092 1984 cmd.exe 83 PID 1984 wrote to memory of 4092 1984 cmd.exe 83 PID 1984 wrote to memory of 3964 1984 cmd.exe 84 PID 1984 wrote to memory of 3964 1984 cmd.exe 84 PID 1984 wrote to memory of 2584 1984 cmd.exe 85 PID 1984 wrote to memory of 2584 1984 cmd.exe 85 PID 2584 wrote to memory of 2500 2584 LavaCraft.exe 92 PID 2584 wrote to memory of 2500 2584 LavaCraft.exe 92 PID 2584 wrote to memory of 2500 2584 LavaCraft.exe 92 PID 2584 wrote to memory of 1712 2584 LavaCraft.exe 94 PID 2584 wrote to memory of 1712 2584 LavaCraft.exe 94 PID 2276 wrote to memory of 184 2276 LavaCraft.exe 104 PID 2276 wrote to memory of 184 2276 LavaCraft.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\LavaCraft.exe"C:\Users\Admin\AppData\Local\Temp\LavaCraft.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\.LavaServer\run.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq LavaCraft.exe" /NH3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:812
-
-
C:\Windows\system32\findstr.exefindstr /i "LavaCraft.exe"3⤵PID:1864
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq LavaCraft.exe" /NH3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\system32\findstr.exefindstr /i "LavaCraft.exe"3⤵PID:3668
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq LavaCraft.exe" /NH3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
C:\Windows\system32\findstr.exefindstr /i "LavaCraft.exe"3⤵PID:2100
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq LavaCraft.exe" /NH3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\system32\findstr.exefindstr /i "LavaCraft.exe"3⤵PID:3964
-
-
C:\Users\Admin\AppData\Roaming\.LavaServer\LavaCraft.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\LavaCraft.exe" "C:\Users\Admin\AppData\Local\Temp\LavaCraft.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Roaming\.LavaServer\7za.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\7za.exe" x -r "C:\Users\Admin\AppData\Roaming\.LavaServer\java64.zip" -o"C:\Users\Admin\AppData\Roaming\.LavaServer\java"4⤵
- Executes dropped EXE
PID:2500
-
-
C:\Users\Admin\AppData\Roaming\.LavaServer\java\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\java\bin\javaw.exe" -XX:+DisableAttachMechanism -Xms512m -Xmx1024m -cp "C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\minecraft.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\jinput.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\lwjgl.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\lwjgl_util.jar" -Djava.library.path="C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\natives" net.minecraft.client.Minecraft Krevetka260 17965171191896505146337618375718292 195.201.156.42 25569 6 http://lavacraft.ru::beget=begetok http://img.lavacraft.ru4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:648
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 000000000002024A /startuptips1⤵
- Checks SCSI registry key(s)
PID:2116
-
C:\Windows\System32\bcastdvr.exe"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:640
-
C:\Users\Admin\AppData\Roaming\.LavaServer\LavaCraft.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\LavaCraft.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Roaming\.LavaServer\java\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\.LavaServer\java\bin\javaw.exe" -XX:+DisableAttachMechanism -Xms512m -Xmx1024m -cp "C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\minecraft.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\jinput.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\lwjgl.jar;C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\lwjgl_util.jar" -Djava.library.path="C:\Users\Admin\AppData\Roaming\.LavaServer\lavacraft6\bin\natives" net.minecraft.client.Minecraft Krevetka260 182530690721203151565 195.201.156.42 25569 6 http://lavacraft.ru::beget=begetok http://img.lavacraft.ru2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:184
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:1360
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 00000000000501DE /startuptips1⤵
- Checks SCSI registry key(s)
PID:1128