Analysis
-
max time kernel
143s -
max time network
134s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 19:40
Static task
static1
Behavioral task
behavioral1
Sample
Inv_36571_VIC_Pty_Ltd.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Inv_36571_VIC_Pty_Ltd.exe
Resource
win10v20201028
General
-
Target
Inv_36571_VIC_Pty_Ltd.exe
-
Size
580KB
-
MD5
5b1363c3b88bd52a0f4044b51c0791d8
-
SHA1
3b1b46eb883c1b79e403e12c3157b6423f13af07
-
SHA256
04b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
-
SHA512
1370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
opera.exeptfile.exeopera.exeptfile.exeopera.exeptfile.exepid process 816 opera.exe 1316 ptfile.exe 800 opera.exe 944 ptfile.exe 1544 opera.exe 1940 ptfile.exe -
Loads dropped DLL 1 IoCs
Processes:
ptfile.exepid process 1480 ptfile.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1244-64-0x0000000000A40000-0x0000000000A61000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\AppData\\Roaming\\opera.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
Inv_36571_VIC_Pty_Ltd.exeptfile.exeopera.exeptfile.exeopera.exeptfile.exeopera.exeptfile.exepid process 1244 Inv_36571_VIC_Pty_Ltd.exe 1480 ptfile.exe 1480 ptfile.exe 1480 ptfile.exe 1480 ptfile.exe 1480 ptfile.exe 816 opera.exe 1316 ptfile.exe 1316 ptfile.exe 1316 ptfile.exe 800 opera.exe 944 ptfile.exe 944 ptfile.exe 944 ptfile.exe 1544 opera.exe 1940 ptfile.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Inv_36571_VIC_Pty_Ltd.exepid process 1244 Inv_36571_VIC_Pty_Ltd.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Inv_36571_VIC_Pty_Ltd.exeptfile.exeopera.exeptfile.exeopera.exeptfile.exeopera.exeptfile.exedescription pid process Token: SeDebugPrivilege 1244 Inv_36571_VIC_Pty_Ltd.exe Token: SeDebugPrivilege 1480 ptfile.exe Token: SeDebugPrivilege 816 opera.exe Token: SeDebugPrivilege 1316 ptfile.exe Token: SeDebugPrivilege 800 opera.exe Token: SeDebugPrivilege 944 ptfile.exe Token: SeDebugPrivilege 1544 opera.exe Token: SeDebugPrivilege 1940 ptfile.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
Inv_36571_VIC_Pty_Ltd.execmd.exeptfile.exeopera.exeptfile.exeopera.exeptfile.exeopera.exedescription pid process target process PID 1244 wrote to memory of 1992 1244 Inv_36571_VIC_Pty_Ltd.exe cmd.exe PID 1244 wrote to memory of 1992 1244 Inv_36571_VIC_Pty_Ltd.exe cmd.exe PID 1244 wrote to memory of 1992 1244 Inv_36571_VIC_Pty_Ltd.exe cmd.exe PID 1244 wrote to memory of 1992 1244 Inv_36571_VIC_Pty_Ltd.exe cmd.exe PID 1992 wrote to memory of 592 1992 cmd.exe reg.exe PID 1992 wrote to memory of 592 1992 cmd.exe reg.exe PID 1992 wrote to memory of 592 1992 cmd.exe reg.exe PID 1992 wrote to memory of 592 1992 cmd.exe reg.exe PID 1244 wrote to memory of 1480 1244 Inv_36571_VIC_Pty_Ltd.exe ptfile.exe PID 1244 wrote to memory of 1480 1244 Inv_36571_VIC_Pty_Ltd.exe ptfile.exe PID 1244 wrote to memory of 1480 1244 Inv_36571_VIC_Pty_Ltd.exe ptfile.exe PID 1244 wrote to memory of 1480 1244 Inv_36571_VIC_Pty_Ltd.exe ptfile.exe PID 1480 wrote to memory of 816 1480 ptfile.exe opera.exe PID 1480 wrote to memory of 816 1480 ptfile.exe opera.exe PID 1480 wrote to memory of 816 1480 ptfile.exe opera.exe PID 1480 wrote to memory of 816 1480 ptfile.exe opera.exe PID 816 wrote to memory of 1316 816 opera.exe ptfile.exe PID 816 wrote to memory of 1316 816 opera.exe ptfile.exe PID 816 wrote to memory of 1316 816 opera.exe ptfile.exe PID 816 wrote to memory of 1316 816 opera.exe ptfile.exe PID 1316 wrote to memory of 800 1316 ptfile.exe opera.exe PID 1316 wrote to memory of 800 1316 ptfile.exe opera.exe PID 1316 wrote to memory of 800 1316 ptfile.exe opera.exe PID 1316 wrote to memory of 800 1316 ptfile.exe opera.exe PID 800 wrote to memory of 944 800 opera.exe ptfile.exe PID 800 wrote to memory of 944 800 opera.exe ptfile.exe PID 800 wrote to memory of 944 800 opera.exe ptfile.exe PID 800 wrote to memory of 944 800 opera.exe ptfile.exe PID 944 wrote to memory of 1544 944 ptfile.exe opera.exe PID 944 wrote to memory of 1544 944 ptfile.exe opera.exe PID 944 wrote to memory of 1544 944 ptfile.exe opera.exe PID 944 wrote to memory of 1544 944 ptfile.exe opera.exe PID 1544 wrote to memory of 1940 1544 opera.exe ptfile.exe PID 1544 wrote to memory of 1940 1544 opera.exe ptfile.exe PID 1544 wrote to memory of 1940 1544 opera.exe ptfile.exe PID 1544 wrote to memory of 1940 1544 opera.exe ptfile.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inv_36571_VIC_Pty_Ltd.exe"C:\Users\Admin\AppData\Local\Temp\Inv_36571_VIC_Pty_Ltd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\opera.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\opera.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\ptfile.exe"C:\Users\Admin\AppData\Local\Temp\ptfile.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\opera.exe"C:\Users\Admin\AppData\Roaming\opera.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ptfile.exe"C:\Users\Admin\AppData\Local\Temp\ptfile.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\opera.exe"C:\Users\Admin\AppData\Roaming\opera.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ptfile.exe"C:\Users\Admin\AppData\Local\Temp\ptfile.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\opera.exe"C:\Users\Admin\AppData\Roaming\opera.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ptfile.exe"C:\Users\Admin\AppData\Local\Temp\ptfile.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ptfile.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
C:\Users\Admin\AppData\Local\Temp\ptfile.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
C:\Users\Admin\AppData\Local\Temp\ptfile.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
C:\Users\Admin\AppData\Roaming\opera.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
C:\Users\Admin\AppData\Roaming\opera.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
C:\Users\Admin\AppData\Roaming\opera.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
C:\Users\Admin\AppData\Roaming\opera.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
C:\Users\Admin\AppData\Roaming\opera.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
C:\Users\Admin\AppData\Roaming\opera.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
\Users\Admin\AppData\Roaming\opera.exeMD5
5b1363c3b88bd52a0f4044b51c0791d8
SHA13b1b46eb883c1b79e403e12c3157b6423f13af07
SHA25604b5f5af6b41722e400498a6540445cfcc1c056b328401eb662fb4d29ee02a5d
SHA5121370e1814663c433cb6c8b69b382e6ac1da1b55ca56aed1b9575d19957b32bd5d2b7835cbf6105e4ec8f2a8acd335dcea0697db123068c7e635b35a087117bd0
-
memory/592-66-0x0000000000000000-mapping.dmp
-
memory/800-105-0x0000000000701000-0x0000000000702000-memory.dmpFilesize
4KB
-
memory/800-98-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/800-96-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/800-93-0x0000000000000000-mapping.dmp
-
memory/816-76-0x0000000000000000-mapping.dmp
-
memory/816-84-0x0000000004CE1000-0x0000000004CE2000-memory.dmpFilesize
4KB
-
memory/816-81-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/816-79-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/944-101-0x0000000000000000-mapping.dmp
-
memory/944-109-0x0000000004841000-0x0000000004842000-memory.dmpFilesize
4KB
-
memory/944-106-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/1244-60-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1244-64-0x0000000000A40000-0x0000000000A61000-memory.dmpFilesize
132KB
-
memory/1244-62-0x00000000042B0000-0x00000000042B1000-memory.dmpFilesize
4KB
-
memory/1244-68-0x00000000042B1000-0x00000000042B2000-memory.dmpFilesize
4KB
-
memory/1316-85-0x0000000000000000-mapping.dmp
-
memory/1316-92-0x00000000049E1000-0x00000000049E2000-memory.dmpFilesize
4KB
-
memory/1316-89-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1480-67-0x0000000000000000-mapping.dmp
-
memory/1480-71-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/1480-74-0x0000000004AC1000-0x0000000004AC2000-memory.dmpFilesize
4KB
-
memory/1544-110-0x0000000000000000-mapping.dmp
-
memory/1544-122-0x0000000004A61000-0x0000000004A62000-memory.dmpFilesize
4KB
-
memory/1544-113-0x0000000001200000-0x0000000001201000-memory.dmpFilesize
4KB
-
memory/1544-115-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/1940-118-0x0000000000000000-mapping.dmp
-
memory/1940-123-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/1940-126-0x0000000004C91000-0x0000000004C92000-memory.dmpFilesize
4KB
-
memory/1992-65-0x0000000000000000-mapping.dmp