Overview

overview

8

Static

static

build_v2.exe

windows7_x64

8

build_v2.exe

windows10_x64

8

Analysis

  • max time kernel
    42s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    17-04-2021 20:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    build_v2.exe

  • Size

    781KB

  • MD5

    ca488b40ff017aa2e5edfb657195b19a

  • SHA1

    8591740a747320a93eef73850a29a109cac17a26

  • SHA256

    5e11767db92bef1591938a448d1d391202e6c8d8ddf0275dc8d72fd375b950db

  • SHA512

    73e99e1da85da472e97b0184a71fbffc39b81dd9daffecd640443413976b147941b79f51b2cc7aa90da68b8ba5a39e5541437c41509ca9280082b5a400c441ca

Score
8/10
evasionpersistenceransomware

Malware Config

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Program crash 1 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build_v2.exe
    "C:\Users\Admin\AppData\Local\Temp\build_v2.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3680
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 7436
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3680-114-0x0000000000B10000-0x0000000000B11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3680-116-0x0000000001510000-0x0000000001511000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3680-117-0x00000000055C0000-0x0000000005675000-memory.dmp
    Filesize

    724KB

    Download
  • memory/3680-118-0x0000000001520000-0x0000000001521000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3680-119-0x0000000005370000-0x0000000005371000-memory.dmp
    Filesize

    4KB

    Download