Analysis
- max time kernel
150s - max time network
140s - platform
windows7_x64 - resource
win7v20210408 - submitted
24/04/2021, 22:31
Static task
static1
Behavioral task
behavioral1
Sample
a2fb3605b4caf84763f44e3dbf8fc14d.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a2fb3605b4caf84763f44e3dbf8fc14d.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target a2fb3605b4caf84763f44e3dbf8fc14d.exe
- Size 27KB
- Sample210424-nc96gmkf5a
- SHA256 76107541a6cff24554d6809a7c690791b73040657c60a73ab31cbfb8a9bd3ffc
- MD5 a2fb3605b4caf84763f44e3dbf8fc14d
- SHA1 a6f5dd2518927631566269b5f0eed51542271046
- SHA512 5ffdd9594518dcf66702d8d4e426b7875fff824d3976485bba36f7715e8d00ad53b52af1c9b641d5a238fc57d4063fb4b6c8f4f7c362ea8c97c35420cdd6cb25
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 332 Payload.exe - Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Payload.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Payload.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Payload.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk a2fb3605b4caf84763f44e3dbf8fc14d.exe - Loads dropped DLL 1 IoCs
pid Process 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe" a2fb3605b4caf84763f44e3dbf8fc14d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe Token: 33 332 Payload.exe Token: SeIncBasePriorityPrivilege 332 Payload.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1668 wrote to memory of 332 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe 29 PID 1668 wrote to memory of 332 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe 29 PID 1668 wrote to memory of 332 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe 29 PID 1668 wrote to memory of 332 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe 29 PID 1668 wrote to memory of 556 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe 30 PID 1668 wrote to memory of 556 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe 30 PID 1668 wrote to memory of 556 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe 30 PID 1668 wrote to memory of 556 1668 a2fb3605b4caf84763f44e3dbf8fc14d.exe 30 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 556 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2fb3605b4caf84763f44e3dbf8fc14d.exe"C:\Users\Admin\AppData\Local\Temp\a2fb3605b4caf84763f44e3dbf8fc14d.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:332
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"2⤵
- Views/modifies file attributes
PID:556
-