Analysis
- max time kernel
149s - max time network
138s - platform
windows10_x64 - resource
win10v20210410 - submitted
24/04/2021, 22:31
Static task
static1
Behavioral task
behavioral1
Sample
a2fb3605b4caf84763f44e3dbf8fc14d.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a2fb3605b4caf84763f44e3dbf8fc14d.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target a2fb3605b4caf84763f44e3dbf8fc14d.exe
- Size 27KB
- Sample210424-nc96gmkf5a
- SHA256 76107541a6cff24554d6809a7c690791b73040657c60a73ab31cbfb8a9bd3ffc
- MD5 a2fb3605b4caf84763f44e3dbf8fc14d
- SHA1 a6f5dd2518927631566269b5f0eed51542271046
- SHA512 5ffdd9594518dcf66702d8d4e426b7875fff824d3976485bba36f7715e8d00ad53b52af1c9b641d5a238fc57d4063fb4b6c8f4f7c362ea8c97c35420cdd6cb25
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 412 Payload.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk a2fb3605b4caf84763f44e3dbf8fc14d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Payload.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Payload.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Payload.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe" a2fb3605b4caf84763f44e3dbf8fc14d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe Token: 33 412 Payload.exe Token: SeIncBasePriorityPrivilege 412 Payload.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3656 wrote to memory of 412 3656 a2fb3605b4caf84763f44e3dbf8fc14d.exe 80 PID 3656 wrote to memory of 412 3656 a2fb3605b4caf84763f44e3dbf8fc14d.exe 80 PID 3656 wrote to memory of 412 3656 a2fb3605b4caf84763f44e3dbf8fc14d.exe 80 PID 3656 wrote to memory of 3152 3656 a2fb3605b4caf84763f44e3dbf8fc14d.exe 81 PID 3656 wrote to memory of 3152 3656 a2fb3605b4caf84763f44e3dbf8fc14d.exe 81 PID 3656 wrote to memory of 3152 3656 a2fb3605b4caf84763f44e3dbf8fc14d.exe 81 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3152 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2fb3605b4caf84763f44e3dbf8fc14d.exe"C:\Users\Admin\AppData\Local\Temp\a2fb3605b4caf84763f44e3dbf8fc14d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"2⤵
- Views/modifies file attributes
PID:3152
-