Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-04-2021 17:33
Static task
static1
Behavioral task
behavioral1
Sample
kFZL7Q3b.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
kFZL7Q3b.exe
Resource
win10v20210408
General
-
Target
kFZL7Q3b.exe
-
Size
29KB
-
MD5
05a677cf02b11ca26d30e538dc56001f
-
SHA1
b82536b603be4f7a9a0231db925129c9efbc777b
-
SHA256
a121587e76f7ab2c542262abbb0904500e9924a44fd2fa89cc9406f9e385ac3e
-
SHA512
408d5697ffe5c567d06faf28a0f85419696dc2e23eb528f92464192c234cadb5c3fcd867c8107defe3f5da90e0eee76634b175ce2c1f6b54e5a43cc62017826f
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
lahana.exepid process 1236 lahana.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
kFZL7Q3b.exepid process 1640 kFZL7Q3b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
lahana.exepid process 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe 1236 lahana.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
lahana.exedescription pid process Token: SeDebugPrivilege 1236 lahana.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
kFZL7Q3b.exelahana.exedescription pid process target process PID 1640 wrote to memory of 1236 1640 kFZL7Q3b.exe lahana.exe PID 1640 wrote to memory of 1236 1640 kFZL7Q3b.exe lahana.exe PID 1640 wrote to memory of 1236 1640 kFZL7Q3b.exe lahana.exe PID 1640 wrote to memory of 1236 1640 kFZL7Q3b.exe lahana.exe PID 1236 wrote to memory of 1760 1236 lahana.exe netsh.exe PID 1236 wrote to memory of 1760 1236 lahana.exe netsh.exe PID 1236 wrote to memory of 1760 1236 lahana.exe netsh.exe PID 1236 wrote to memory of 1760 1236 lahana.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kFZL7Q3b.exe"C:\Users\Admin\AppData\Local\Temp\kFZL7Q3b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lahana.exe"C:\Users\Admin\AppData\Local\Temp\lahana.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\lahana.exe" "lahana.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lahana.exeMD5
05a677cf02b11ca26d30e538dc56001f
SHA1b82536b603be4f7a9a0231db925129c9efbc777b
SHA256a121587e76f7ab2c542262abbb0904500e9924a44fd2fa89cc9406f9e385ac3e
SHA512408d5697ffe5c567d06faf28a0f85419696dc2e23eb528f92464192c234cadb5c3fcd867c8107defe3f5da90e0eee76634b175ce2c1f6b54e5a43cc62017826f
-
C:\Users\Admin\AppData\Local\Temp\lahana.exeMD5
05a677cf02b11ca26d30e538dc56001f
SHA1b82536b603be4f7a9a0231db925129c9efbc777b
SHA256a121587e76f7ab2c542262abbb0904500e9924a44fd2fa89cc9406f9e385ac3e
SHA512408d5697ffe5c567d06faf28a0f85419696dc2e23eb528f92464192c234cadb5c3fcd867c8107defe3f5da90e0eee76634b175ce2c1f6b54e5a43cc62017826f
-
\Users\Admin\AppData\Local\Temp\lahana.exeMD5
05a677cf02b11ca26d30e538dc56001f
SHA1b82536b603be4f7a9a0231db925129c9efbc777b
SHA256a121587e76f7ab2c542262abbb0904500e9924a44fd2fa89cc9406f9e385ac3e
SHA512408d5697ffe5c567d06faf28a0f85419696dc2e23eb528f92464192c234cadb5c3fcd867c8107defe3f5da90e0eee76634b175ce2c1f6b54e5a43cc62017826f
-
memory/1236-61-0x0000000000000000-mapping.dmp
-
memory/1236-66-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1236-69-0x0000000000321000-0x0000000000322000-memory.dmpFilesize
4KB
-
memory/1236-70-0x0000000000326000-0x0000000000337000-memory.dmpFilesize
68KB
-
memory/1640-59-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/1640-65-0x00000000020E0000-0x00000000020E1000-memory.dmpFilesize
4KB
-
memory/1760-67-0x0000000000000000-mapping.dmp