Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-04-2021 15:21
Static task
static1
Behavioral task
behavioral1
Sample
Vid_439430_pac_934843.exe
Resource
win7v20210410
General
-
Target
Vid_439430_pac_934843.exe
-
Size
1.3MB
-
MD5
ce572029aaca7d1613ec12caf4bcd431
-
SHA1
ff71ea43c2af9304e2c3a61bb1f54879d092683e
-
SHA256
be1f798fcf2591f54609b93ae15d8eccad68946aa02eebd48d7b8f015e468809
-
SHA512
e3d419d1db0b335270696fc93f2f1c71919ea13e0622fe37976f6f1e75e95d0a34b5a0c83fbde270c4b5e02d850dd88958c6540e070e910fb2342a7b7be6dc35
Malware Config
Extracted
remcos
sungito.zklg.net:4033
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cksakbkn.pifpid process 2000 cksakbkn.pif -
Loads dropped DLL 4 IoCs
Processes:
Vid_439430_pac_934843.exepid process 1864 Vid_439430_pac_934843.exe 1864 Vid_439430_pac_934843.exe 1864 Vid_439430_pac_934843.exe 1864 Vid_439430_pac_934843.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cksakbkn.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cksakbkn.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\64481923\\cksakbkn.pif C:\\Users\\Admin\\64481923\\SPTODP~1.TMP" cksakbkn.pif -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cksakbkn.pifdescription pid process target process PID 2000 set thread context of 772 2000 cksakbkn.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cksakbkn.pifpid process 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif 2000 cksakbkn.pif -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 772 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 772 RegSvcs.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Vid_439430_pac_934843.execksakbkn.pifdescription pid process target process PID 1864 wrote to memory of 2000 1864 Vid_439430_pac_934843.exe cksakbkn.pif PID 1864 wrote to memory of 2000 1864 Vid_439430_pac_934843.exe cksakbkn.pif PID 1864 wrote to memory of 2000 1864 Vid_439430_pac_934843.exe cksakbkn.pif PID 1864 wrote to memory of 2000 1864 Vid_439430_pac_934843.exe cksakbkn.pif PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe PID 2000 wrote to memory of 772 2000 cksakbkn.pif RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vid_439430_pac_934843.exe"C:\Users\Admin\AppData\Local\Temp\Vid_439430_pac_934843.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\64481923\cksakbkn.pif"C:\Users\Admin\64481923\cksakbkn.pif" sptodpihal.tmp2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\64481923\cksakbkn.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
C:\Users\Admin\64481923\sptodpihal.tmpMD5
c573ce59dd846967646f4021ccc92669
SHA1c96bbf35ff635bbff0a191f3bdb046eb539141cb
SHA256616d751dfaad93aaf626502db4132904753fc6f04e02544b4810b19071727a48
SHA512eb972067822333f5b4eb79dd24fb1ca55f0c164b5135e72c6298f91cd6ba97686c2267c652a3f8c84a98d338b4d1d3fea6823604938f818f908c75aad0b2b0cc
-
C:\Users\Admin\64481923\wvwehlvk.jpgMD5
ff72fe9f666078c6da13980312f8f6c6
SHA13bbb574ef4f5744d83397755475d046cf36cb7a4
SHA256ca4fa2af0f6024a7cb35af4ba673ec4398272aadb7b9806136a5ddd1a13d1d61
SHA51228744237a31e1ab07c7a7bfa13276fc4bb2c66746cc5335aa2d706e6481d39d539d9a366e9e938e942153ff3dbcfdc55f546b9478df54f8c3ed44b7a56438ac7
-
\Users\Admin\64481923\cksakbkn.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
\Users\Admin\64481923\cksakbkn.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
\Users\Admin\64481923\cksakbkn.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
\Users\Admin\64481923\cksakbkn.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
memory/772-69-0x0000000000360000-0x0000000000859000-memory.dmpFilesize
5.0MB
-
memory/772-70-0x000000000038EEEF-mapping.dmp
-
memory/772-72-0x0000000000360000-0x0000000000859000-memory.dmpFilesize
5.0MB
-
memory/1864-59-0x0000000076A81000-0x0000000076A83000-memory.dmpFilesize
8KB
-
memory/2000-64-0x0000000000000000-mapping.dmp