Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-04-2021 18:02
Static task
static1
Behavioral task
behavioral1
Sample
uEhCwMFD.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
uEhCwMFD.exe
Resource
win10v20210410
General
-
Target
uEhCwMFD.exe
-
Size
29KB
-
MD5
4666a4144de0c73bfdc0408a74f9b851
-
SHA1
a56729b1ef81d5fa63e8653d3f128f7af8c006a3
-
SHA256
ecf161f5835d8bb37183dc34367260df19269ca98c80ff07f3a602ce673826e7
-
SHA512
660ea19a8e396a532ee49c8fcbab4c4f2dfab29601e2759ab19ace2c933723e515aa79f33da0e23d3c8ba494a441373f8133f27727075643de4084cc7069f62f
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
lahana.exepid process 1960 lahana.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
uEhCwMFD.exepid process 1676 uEhCwMFD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
lahana.exepid process 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe 1960 lahana.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
lahana.exedescription pid process Token: SeDebugPrivilege 1960 lahana.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
uEhCwMFD.exelahana.exedescription pid process target process PID 1676 wrote to memory of 1960 1676 uEhCwMFD.exe lahana.exe PID 1676 wrote to memory of 1960 1676 uEhCwMFD.exe lahana.exe PID 1676 wrote to memory of 1960 1676 uEhCwMFD.exe lahana.exe PID 1676 wrote to memory of 1960 1676 uEhCwMFD.exe lahana.exe PID 1960 wrote to memory of 1708 1960 lahana.exe netsh.exe PID 1960 wrote to memory of 1708 1960 lahana.exe netsh.exe PID 1960 wrote to memory of 1708 1960 lahana.exe netsh.exe PID 1960 wrote to memory of 1708 1960 lahana.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\uEhCwMFD.exe"C:\Users\Admin\AppData\Local\Temp\uEhCwMFD.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\lahana.exe"C:\Users\Admin\AppData\Local\Temp\lahana.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\lahana.exe" "lahana.exe" ENABLE3⤵PID:1708
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lahana.exeMD5
4666a4144de0c73bfdc0408a74f9b851
SHA1a56729b1ef81d5fa63e8653d3f128f7af8c006a3
SHA256ecf161f5835d8bb37183dc34367260df19269ca98c80ff07f3a602ce673826e7
SHA512660ea19a8e396a532ee49c8fcbab4c4f2dfab29601e2759ab19ace2c933723e515aa79f33da0e23d3c8ba494a441373f8133f27727075643de4084cc7069f62f
-
C:\Users\Admin\AppData\Local\Temp\lahana.exeMD5
4666a4144de0c73bfdc0408a74f9b851
SHA1a56729b1ef81d5fa63e8653d3f128f7af8c006a3
SHA256ecf161f5835d8bb37183dc34367260df19269ca98c80ff07f3a602ce673826e7
SHA512660ea19a8e396a532ee49c8fcbab4c4f2dfab29601e2759ab19ace2c933723e515aa79f33da0e23d3c8ba494a441373f8133f27727075643de4084cc7069f62f
-
\Users\Admin\AppData\Local\Temp\lahana.exeMD5
4666a4144de0c73bfdc0408a74f9b851
SHA1a56729b1ef81d5fa63e8653d3f128f7af8c006a3
SHA256ecf161f5835d8bb37183dc34367260df19269ca98c80ff07f3a602ce673826e7
SHA512660ea19a8e396a532ee49c8fcbab4c4f2dfab29601e2759ab19ace2c933723e515aa79f33da0e23d3c8ba494a441373f8133f27727075643de4084cc7069f62f
-
memory/1676-59-0x0000000075971000-0x0000000075973000-memory.dmpFilesize
8KB
-
memory/1676-66-0x00000000020D0000-0x00000000020D1000-memory.dmpFilesize
4KB
-
memory/1708-65-0x0000000000000000-mapping.dmp
-
memory/1960-61-0x0000000000000000-mapping.dmp
-
memory/1960-67-0x0000000002100000-0x0000000002101000-memory.dmpFilesize
4KB
-
memory/1960-69-0x0000000002101000-0x0000000002102000-memory.dmpFilesize
4KB
-
memory/1960-70-0x0000000002106000-0x0000000002117000-memory.dmpFilesize
68KB